hxxps://sosigma[.]xyz

Analysis

max time kernel
2100s
max time network
2102s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/12/2024, 14:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://sosigma.xyz

Score

8^/10

steam discovery persistence phishing

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 20 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation	steamwebhelper.exe

Executes dropped EXE 61 IoCs

pid	Process
4712	SteamSetup.exe
1644	SteamSetup.exe
4808	steamservice.exe
3908	steam.exe
2068	steam.exe
1496	steamwebhelper.exe
4992	steamwebhelper.exe
2340	steamwebhelper.exe
1600	steamwebhelper.exe
3496	gldriverquery64.exe
2088	steamwebhelper.exe
3976	steamwebhelper.exe
1860	gldriverquery.exe
380	vulkandriverquery64.exe
4340	vulkandriverquery.exe
2964	steamwebhelper.exe
1556	steamwebhelper.exe
1240	steamwebhelper.exe
2184	steamwebhelper.exe
3496	steamwebhelper.exe
1464	steamwebhelper.exe
1760	steamwebhelper.exe
3392	steamwebhelper.exe
5056	steamwebhelper.exe
6312	steamwebhelper.exe
5248	x64launcher.exe
5264	Gorilla Tag.exe
5212	UnityCrashHandler64.exe
6360	GameOverlayUI.exe
6524	UnityCrashHandler64.exe
2648	x64launcher.exe
7164	Gorilla Tag.exe
5388	UnityCrashHandler64.exe
4564	GameOverlayUI.exe
5244	steamwebhelper.exe
6372	steamwebhelper.exe
6156	steamwebhelper.exe
6496	steamwebhelper.exe
5584	steamwebhelper.exe
5312	steamerrorreporter.exe
1992	steamerrorreporter.exe
6540	UnityCrashHandler64.exe
6696	Steam.exe
4716	steamwebhelper.exe
6860	steamwebhelper.exe
3004	steamwebhelper.exe
7124	steamwebhelper.exe
6972	gldriverquery64.exe
5844	gldriverquery.exe
3628	steamwebhelper.exe
5764	steamwebhelper.exe
4912	vulkandriverquery64.exe
3320	vulkandriverquery.exe
5368	steamwebhelper.exe
4680	steamwebhelper.exe
5236	steamwebhelper.exe
4280	steamwebhelper.exe
5520	steamwebhelper.exe
6580	steamwebhelper.exe
5792	steamwebhelper.exe
6312	steamwebhelper.exe

Loads dropped DLL 64 IoCs

pid	Process
4712	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
1644	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
2068	steam.exe
2068	steam.exe
2068	steam.exe
2068	steam.exe
2068	steam.exe
2068	steam.exe
2068	steam.exe
2068	steam.exe
2068	steam.exe
2068	steam.exe
2068	steam.exe
2068	steam.exe
2068	steam.exe
2068	steam.exe
2068	steam.exe
2068	steam.exe
1496	steamwebhelper.exe
1496	steamwebhelper.exe
1496	steamwebhelper.exe
1496	steamwebhelper.exe
4992	steamwebhelper.exe
4992	steamwebhelper.exe
4992	steamwebhelper.exe
2340	steamwebhelper.exe
2340	steamwebhelper.exe
2068	steam.exe
2340	steamwebhelper.exe
2340	steamwebhelper.exe
2340	steamwebhelper.exe
2340	steamwebhelper.exe
2068	steam.exe
2340	steamwebhelper.exe
2340	steamwebhelper.exe
2340	steamwebhelper.exe
1600	steamwebhelper.exe
1600	steamwebhelper.exe
1600	steamwebhelper.exe
2068	steam.exe
2088	steamwebhelper.exe
2088	steamwebhelper.exe
2088	steamwebhelper.exe
3976	steamwebhelper.exe
3976	steamwebhelper.exe
3976	steamwebhelper.exe
3976	steamwebhelper.exe
2068	steam.exe
2964	steamwebhelper.exe
2964	steamwebhelper.exe
2964	steamwebhelper.exe
2964	steamwebhelper.exe
1556	steamwebhelper.exe
1556	steamwebhelper.exe
1556	steamwebhelper.exe
1556	steamwebhelper.exe
1240	steamwebhelper.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent"	SteamSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
409	ip-api.com

Detected potential entity reuse from brand STEAM.
phishing steam

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\dll\kernelbase.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\symbols\DLL\kernel32.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\kernelbase.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\dll\kernelbase.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\symbols\dll\kernelbase.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\mono-2.0-bdwgc.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\symbols\dll\ntdll.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\kernelbase.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\ntdll.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\dll\mono-2.0-bdwgc.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\symbols\dll\mono-2.0-bdwgc.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\DLL\kernel32.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	Gorilla Tag.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 5248 set thread context of 5264	5248	x64launcher.exe	183
PID 5264 set thread context of 5212	5264	Gorilla Tag.exe	185
PID 5212 set thread context of 6524	5212	UnityCrashHandler64.exe	194
PID 2648 set thread context of 7164	2648	x64launcher.exe	196
PID 7164 set thread context of 5388	7164	Gorilla Tag.exe	198
PID 5388 set thread context of 6540	5388	UnityCrashHandler64.exe	218

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\SubChangePasswordChangePassword.res_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_button_a_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\appcache\librarycache\1245040_icon.jpg	steam.exe
File opened for modification	C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\Managed\System.EnterpriseServices.dll	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_035_magic_0313.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_mouse_5_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\sp.js_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\rampDown_4.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\friends\trackerui_danish.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sc_button_l_arrow_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\offline_portuguese.html_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\steamui_german.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\steamui_postlogon_sc_schinese.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_outlined_button_b_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_050_menu_0080.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_button_x.svg_	steam.exe
File opened for modification	C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\Managed\Meta.Voice.Samples.ShapesConduit.dll	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_100_target_0150.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\icon_dropdown.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\btnOvrOffRight.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\icon_security_poor.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps_color_outlined_button_triangle.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_mouse_scroll_down_md.png_	steam.exe
File opened for modification	C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\Plugins\x86_64\lib_burst_generated.dll	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\switch_controller_english.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\switchpro_lstick_right.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_gyro_yaw_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\switch_controller_turkish.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_trackpad_md.png_	steam.exe
File opened for modification	C:\Program Files (x86)\Steam\steamapps\downloading\1533390\Gorilla Tag_Data\Managed\UnityEngine.ClusterInputModule.dll	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_dpad_up_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\nobigpicturevista.res_	steam.exe
File opened for modification	C:\Program Files (x86)\Steam\steamapps\downloading\1533390\Gorilla Tag_Data\StreamingAssets\SteamVR\actions.json	steam.exe
File opened for modification	C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\StreamingAssets\SteamVR\OpenVRSettings.asset	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sc_dpad_touch_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\switchpro_dpad_down_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps_outlined_button_x_sm.png_	steam.exe
File opened for modification	C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\StreamingAssets\aa\StandaloneWindows64\1fb2a52691ee72a916d91e99d5f07a99_unitybuiltinshaders_d8e38523d61466f41865fca6327b69f8.bundle	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_060_vehicle_0110.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_r3_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\friends\ClanEventNotification.res_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sd_rtrackpad_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps4_trackpad_l_ring_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_trackpad.svg_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\textentry_focus.tga_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sc_dpad_left_sm.png_	steam.exe
File opened for modification	C:\Program Files (x86)\Steam\steamapps\downloading\1533390\Gorilla Tag_Data\Managed\Unity.Collections.dll	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\xbox_one_russian.txt_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_outlined_button_b_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sd_rtrackpad_swipe_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\templates\gamepad_mouse_gyro.vdf_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\localization\steamui_romanian-json.js_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps5_trackpad_right_lg.png_	steam.exe
File created	C:\Program Files (x86)\Steam\appcache\librarycache\261140_icon.jpg	steam.exe
File opened for modification	C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\MonoBleedingEdge\EmbedRuntime\mono-2.0-bdwgc.dll	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_rstick_down_md.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sc_button_r_arrow_sm.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\layout\downloadsummarypanel.layout_	steam.exe
File opened for modification	C:\Program Files (x86)\Steam\steamapps\downloading\1533390\Gorilla Tag_Data\level6.resS	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_010_wpn_0427.png_	steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\icon_friends.tga_	steam.exe

Drops file in Windows directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\dll\ntdll.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\kernelbase.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\ntdll.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\kernel32.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\mono-2.0-bdwgc.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\dll\mono-2.0-bdwgc.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\DLL\kernel32.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\symbols\dll\mono-2.0-bdwgc.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\ntdll.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\kernelbase.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\symbols\dll\kernelbase.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\kernel32.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\symbols\dll\ntdll.pdb	Gorilla Tag.exe
File opened for modification	C:\Windows\symbols\DLL\kernel32.pdb	Gorilla Tag.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gldriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vulkandriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GameOverlayUI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GameOverlayUI.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamerrorreporter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steam.exe

Checks SCSI registry key(s) 3 TTPs 11 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Gorilla Tag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Gorilla Tag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Gorilla Tag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Gorilla Tag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Gorilla Tag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Gorilla Tag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Gorilla Tag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Gorilla Tag.exe

Checks processor information in registry 2 TTPs 18 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GameOverlayUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GameOverlayUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	GameOverlayUI.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	GameOverlayUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steam\Shell	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steam.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steam	Steam.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steam\DefaultIcon	Steam.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steamlink\DefaultIcon	Steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steamlink\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steam\URL Protocol	Steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	Steam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steam\DefaultIcon	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	Steam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steamlink	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steam	steam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\Steam.exe\" -- \"%1\""	Steam.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	Steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steam\URL Protocol	steam.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steam\Shell\Open\Command	Steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	Steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	Steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	Steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steamlink\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	Steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	Steam.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	Steam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\Steam.exe\" -- \"%1\""	Steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steam\ = "URL:steam protocol"	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steam\DefaultIcon\ = "Steam.exe"	Steam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	Steam.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000_Classes\steamlink\DefaultIcon	steam.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	steam.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 537757.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1460	msedge.exe
1460	msedge.exe
3032	msedge.exe
3032	msedge.exe
2276	identity_helper.exe
2276	identity_helper.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
4196	msedge.exe
4196	msedge.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
4712	SteamSetup.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2068	steam.exe
6696	Steam.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	4808	steamservice.exe
Token: SeSecurityPrivilege	4808	steamservice.exe
Token: SeDebugPrivilege	1432	taskmgr.exe
Token: SeSystemProfilePrivilege	1432	taskmgr.exe
Token: SeCreateGlobalPrivilege	1432	taskmgr.exe
Token: 33	1432	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1432	taskmgr.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	1496	steamwebhelper.exe
Token: SeShutdownPrivilege	1496	steamwebhelper.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3908	steam.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe
1432	taskmgr.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
4712	SteamSetup.exe
1644	SteamSetup.exe
4808	steamservice.exe
2068	steam.exe
5264	Gorilla Tag.exe
7164	Gorilla Tag.exe
6696	Steam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 4072	3032	msedge.exe	83
PID 3032 wrote to memory of 4072	3032	msedge.exe	83
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1544	3032	msedge.exe	84
PID 3032 wrote to memory of 1460	3032	msedge.exe	85
PID 3032 wrote to memory of 1460	3032	msedge.exe	85
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86
PID 3032 wrote to memory of 2748	3032	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://sosigma.xyz
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb76ff46f8,0x7ffb76ff4708,0x7ffb76ff4718
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3896 /prefetch:1
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5444 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1272 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,17712577060863817842,9029853333289068626,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4196
- C:\Users\Admin\Downloads\SteamSetup.exe
  "C:\Users\Admin\Downloads\SteamSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4712
- - C:\Program Files (x86)\Steam\bin\steamservice.exe
    "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4808
- C:\Users\Admin\Downloads\SteamSetup.exe
  "C:\Users\Admin\Downloads\SteamSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1556

C:\Program Files (x86)\Steam\steam.exe
"C:\Program Files (x86)\Steam\steam.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
PID:3908
- C:\Program Files (x86)\Steam\steam.exe
  "C:\Program Files (x86)\Steam\steam.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies registry class
  - Modifies system certificate store
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2068
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=2068" "-buildid=1733265492" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal,ValveFFmpegAllowLowDelayHEVC"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:1496
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1733265492 --initial-client-data=0x280,0x284,0x288,0x27c,0x28c,0x7ffb851daf00,0x7ffb851daf0c,0x7ffb851daf18
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:4992
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1588,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=1592 --mojo-platform-channel-handle=1580 /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2340
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=2200,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2204 --mojo-platform-channel-handle=2196 /prefetch:3
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:1600
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=2548,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2552 --mojo-platform-channel-handle=2172 /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:2088
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3172,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3176 --mojo-platform-channel-handle=3168 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:3976
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3948,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3952 --mojo-platform-channel-handle=3944 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:2964
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3608,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4068 --mojo-platform-channel-handle=4076 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:1556
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4304,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4564 --mojo-platform-channel-handle=4156 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      PID:1240
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=4684,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4688 --mojo-platform-channel-handle=4680 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:2184
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4868,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4836 --mojo-platform-channel-handle=4852 /prefetch:1
      4⤵
      Executes dropped EXE
      PID:1464
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4504,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4508 --mojo-platform-channel-handle=4468 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:3496
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4692,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4708 --mojo-platform-channel-handle=4700 /prefetch:1
      4⤵
      Executes dropped EXE
      PID:3392
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4764,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4152 --mojo-platform-channel-handle=4788 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:1760
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4740,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4744 --mojo-platform-channel-handle=4736 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:5056
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=4952,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3616 --mojo-platform-channel-handle=5040 /prefetch:8
      4⤵
      Executes dropped EXE
      PID:6312
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3780,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3776 --mojo-platform-channel-handle=3768 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:5244
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4988,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3200 --mojo-platform-channel-handle=4056 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:6372
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3516,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4036 --mojo-platform-channel-handle=3888 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:6156
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5132,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=5124 --mojo-platform-channel-handle=4244 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:6496
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=4036,i,7147920437964673217,1692228234459364340,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=5252 --mojo-platform-channel-handle=3992 /prefetch:1
      4⤵
      Checks computer location settings
      Executes dropped EXE
      PID:5584
- - C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
    .\bin\gldriverquery64.exe
    3⤵
    - Executes dropped EXE
    PID:3496
- - C:\Program Files (x86)\Steam\bin\gldriverquery.exe
    .\bin\gldriverquery.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1860
- - C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
    .\bin\vulkandriverquery64.exe
    3⤵
    - Executes dropped EXE
    PID:380
- - C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
    .\bin\vulkandriverquery.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4340
- - C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag.exe
    "C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag.exe" -vrmode openvr
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of SetWindowsHookEx
    PID:5264
  - - C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe
      "C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe" --attach 5264 2113787465728
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:5212
    - - C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe
        
        "C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe" "5264" "2113787465728"
        5⤵
        Executes dropped EXE
        
        PID:6524
- - C:\Program Files (x86)\Steam\bin\x64launcher.exe
    "C:\Program Files (x86)\Steam\bin\x64launcher.exe" -hproc 1124 -hthread 11b8 -baseoverlayname C:\Program Files (x86)\Steam\gameoverlayrenderer64.dll
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:5248
- - C:\Program Files (x86)\Steam\GameOverlayUI.exe
    "C:\Program Files (x86)\Steam\GameOverlayUI.exe" -pid 5264 -steampid 2068 -manuallyclearframes 0 -gameid 1533390
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:6360
- - C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag.exe
    "C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag.exe" -vrmode openvr
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Drops file in Windows directory
    - Checks SCSI registry key(s)
    - Suspicious use of SetWindowsHookEx
    PID:7164
  - - C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe
      "C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe" --attach 7164 1685794983936
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:5388
    - - C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe
        
        "C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe" "7164" "1685794983936"
        5⤵
        Executes dropped EXE
        
        PID:6540
- - C:\Program Files (x86)\Steam\bin\x64launcher.exe
    "C:\Program Files (x86)\Steam\bin\x64launcher.exe" -hproc 1060 -hthread 1098 -baseoverlayname C:\Program Files (x86)\Steam\gameoverlayrenderer64.dll
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    PID:2648
- - C:\Program Files (x86)\Steam\GameOverlayUI.exe
    "C:\Program Files (x86)\Steam\GameOverlayUI.exe" -pid 7164 -steampid 2068 -manuallyclearframes 0 -gameid 1533390
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    PID:4564
  - - C:\Program Files (x86)\Steam\steamerrorreporter.exe
      C:\Program Files (x86)\Steam\steam
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1992
- - C:\Program Files (x86)\Steam\steamerrorreporter.exe
    C:\Program Files (x86)\Steam\steam
    3⤵
    - Executes dropped EXE
    PID:5312

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1432

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x540 0x2ec
1⤵
PID:1704

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\42a300f475854ae3b97100e93ed96ade /t 736 /p 7164
1⤵
PID:3024

C:\Program Files (x86)\Steam\Steam.exe
"C:\Program Files (x86)\Steam\Steam.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:6696
- C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
  "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=6696" "-buildid=1733265492" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal,ValveFFmpegAllowLowDelayHEVC"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks processor information in registry
  PID:4716
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1733265492 --initial-client-data=0x280,0x284,0x288,0x27c,0x28c,0x7ffb74c9af00,0x7ffb74c9af0c,0x7ffb74c9af18
    3⤵
    - Executes dropped EXE
    PID:6860
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1592,i,12718890093605390847,2274372003532529160,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=1596 --mojo-platform-channel-handle=1584 /prefetch:2
    3⤵
    - Executes dropped EXE
    PID:3004
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=2260,i,12718890093605390847,2274372003532529160,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2264 --mojo-platform-channel-handle=2256 /prefetch:3
    3⤵
    - Executes dropped EXE
    PID:7124
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=2804,i,12718890093605390847,2274372003532529160,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2808 --mojo-platform-channel-handle=2800 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:3628
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3180,i,12718890093605390847,2274372003532529160,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3184 --mojo-platform-channel-handle=3176 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:5764
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3888,i,12718890093605390847,2274372003532529160,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3892 --mojo-platform-channel-handle=3884 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:5368
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4080,i,12718890093605390847,2274372003532529160,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4084 --mojo-platform-channel-handle=4076 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:4680
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3816,i,12718890093605390847,2274372003532529160,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4408 --mojo-platform-channel-handle=4460 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:5236
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4476,i,12718890093605390847,2274372003532529160,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4564 --mojo-platform-channel-handle=4588 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:4280
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3788,i,12718890093605390847,2274372003532529160,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4592 --mojo-platform-channel-handle=3820 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:5520
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4460,i,12718890093605390847,2274372003532529160,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4388 --mojo-platform-channel-handle=4316 /prefetch:1
    3⤵
    - Executes dropped EXE
    PID:5792
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3900,i,12718890093605390847,2274372003532529160,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4296 --mojo-platform-channel-handle=4400 /prefetch:1
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    PID:6580
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2072,i,12718890093605390847,2274372003532529160,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2076 --mojo-platform-channel-handle=1176 /prefetch:8
    3⤵
    - Executes dropped EXE
    PID:6312
- C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
  .\bin\gldriverquery64.exe
  2⤵
  - Executes dropped EXE
  PID:6972
- C:\Program Files (x86)\Steam\bin\gldriverquery.exe
  .\bin\gldriverquery.exe
  2⤵
  - Executes dropped EXE
  PID:5844
- C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
  .\bin\vulkandriverquery64.exe
  2⤵
  - Executes dropped EXE
  PID:4912
- C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
  .\bin\vulkandriverquery.exe
  2⤵
  - Executes dropped EXE
  PID:3320

C:\Windows\system32\rundll32.exe
C:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask
1⤵
PID:64

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Steam\Steam.exe

Filesize
4.2MB

MD5
33bcb1c8975a4063a134a72803e0ca16

SHA1
ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65

SHA256
12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1

SHA512
13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49

Download Submit
C:\Program Files (x86)\Steam\appcache\librarycache\1161040_icon.jpg

Filesize
638B

MD5
7ecdaf8a54ec52b20640a88527512903

SHA1
3133a4d748ad3be61fe9db759339cd5de73339b5

SHA256
7bd8b75aec0a4d4a377f3ca3a023fd8b7c5fc7dc6a2a66d17f8cdfe5b731ab0c

SHA512
60ae2031eed0c38264f0d8db22a9b6efeb3f80c791e916e15a1730853162d56e0da014dbd93a5479bae4f3bdd5705ca89be70c90574a524abd1c276ed5c55a2d

Download Submit
C:\Program Files (x86)\Steam\appcache\librarycache\assets.vdf.async6696.tmp

Filesize
12KB

MD5
c045d1942101554bbbf3637b59f42db2

SHA1
7d6d63fa214534d4c4d440f8ec127fe949f5a65f

SHA256
fe911c91fbcdd7dc0e8e676d062221650e0604be7b55d2b15519c8dfbd901f0f

SHA512
96cc13ea2f33db452201edecdf67f41987ab0d30cc3805575dd2ec103303471c0e232edea5e05f18d94a5836104e07c7ca2ea9a4848577ea3734ac70484d9c75

Download Submit
C:\Program Files (x86)\Steam\bin\SteamService.exe

Filesize
2.5MB

MD5
ba0ea9249da4ab8f62432617489ae5a6

SHA1
d8873c5dcb6e128c39cf0c423b502821343659a7

SHA256
ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d

SHA512
52958d55b03e1ddc69afc2f1a02f7813199e4b3bf114514c438ab4d10d5ca83b865ba6090550951c0a43b666c6728304009572212444a27a3f5184663f4b0b8b

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
15KB

MD5
f41259592253d0b3966364f6884439a3

SHA1
8691050c194ed5c8374904d4d3ccc18812dfefb3

SHA256
72ff23ad37637f9ba1f0e96cab8775290cc1abf9e95dc39ae829129515d4851d

SHA512
195c42f44b1e9526ff2c167224963044ec75abbbe39f6e90308364abfcd3aba47f0b8c31a3a2f485cf8b17238f488cf7c39417ff78d340392f106ea5c2533ccb

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
24KB

MD5
85518c09695fe9079f976467737936be

SHA1
bb9e14bc63df5cc235c8eb595fa688585b6da9e6

SHA256
a621e10f7ad408df4fb36fa1ca4ab9cf37b46e0270c1abc7ec508adf9f2fd5e7

SHA512
471d36be7b93e3f325146fd7933936511b3d04a49bd91e881500d690f75b3aa99dace05e5da6df6f157946d765993f22bad39067e638f86c91d26065dbabd817

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
22KB

MD5
f149df0a9415a15f56cf32c7f209ad9a

SHA1
1041a4465ebdeb0ebfe99f9a896eb7545c647ed4

SHA256
d25397355f30bd192652be4287259932faaba448771fee503397d356ab279bb8

SHA512
b528dee7e22408f61b0f65e78ee4979c0477e3687ea9a0ee1f623f04c44a0518d71d1134d196f811d0a9082a71797e17c17a436bfd98079cae2228c43020b4ef

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
1KB

MD5
a2ec2e91c3ef8c42e22c4887d032b333

SHA1
e2c738a2e9400535b74e2263c7e7d1ecefe575f2

SHA256
8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3

SHA512
b069d241efb19e09ec8b5e60ef6c43e00d5cc0f774b9340127c2180356dd1964ac625c1afdfaee5f99e72b26f56046fc329aadbbc365b403af765a55e9c9aab3

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf~RFe6656c2.TMP

Filesize
1KB

MD5
6e6a2b18264504cc084caa3ad0bfc6ae

SHA1
b177d719bd3c1bc547d5c97937a584b8b7d57196

SHA256
f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53

SHA512
74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679

Download Submit
C:\Program Files (x86)\Steam\dumps\reports\08ddbd07-3ea6-4dfe-8e18-5cbefe09dd04.dmp

Filesize
1.3MB

MD5
06e49a4c2f5130c92dfdb134c08a11cb

SHA1
4906b887105a1f7ea3d4d299ac16f6d0944bd2bd

SHA256
e009f8a84f7543ca79ffc2badad60e6a542b8926d10d667baa46dedc226c539b

SHA512
ab4ea7c3d878c3df68f439648d0fa8e63c319f4dec3e597641cf74d0563923d8c77e7cb0547140e5c8f903cf31afdc2fcb36c6422d08002926f504e1188a6e46

Download Submit
C:\Program Files (x86)\Steam\dumps\reports\c5c7d977-99f5-48e1-9e33-73c1fd1d61b1.dmp

Filesize
724KB

MD5
bdd77382f6b51fb7903b1aa084c3a25d

SHA1
938937ca91cbac9a0c11a67a60eb6d8e990eea72

SHA256
30f0873bdc4b993443784c5f3d4c3960514fc4e4c7a855e5b4f540f263a26be8

SHA512
567156d6e3b2e42179ad7071c1e202f307f712315aa5354f1f508c518a7594ebced030221f916164a9101ac4e07cacc8942f38f895bd2cd9e7d58f2d9ff94e92

Download Submit
C:\Program Files (x86)\Steam\dumps\settings.dat

Filesize
56B

MD5
94eba62633d8acf77c429e02ff56c63c

SHA1
2603d0d98de9c40318658f6c30668e82b6a5e340

SHA256
9ceef4e68107d379e094763be556fe76fd93f56bc8ca76ae00d5a216c2977f91

SHA512
55b307e4c5eafbd3f9a6d321ba295b105932402fda70b1bb3d86e03c0ca57f552fafaa80ccf789de605bb91b25961865e57f175c55d0727051d8d77fc04c74d4

Download Submit
C:\Program Files (x86)\Steam\logs\cef_log.txt

Filesize
33KB

MD5
05003e0dc5a94fbe6ac592447eca7ba4

SHA1
eb6a25eece7a155f83beb6deee4e09d5d9abb761

SHA256
a0b3c5288107125158932884db90adb16c883ee3adfe524a60f8bbde643fd01a

SHA512
34a7d2d59cbee41b941fd110c17338970f206b451459fd52c336c9a785224af2fec93de03440edaa6b573eb736a8ce4ee83d5738bd54d17a6983dcfc060ee157

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_

Filesize
15KB

MD5
577b7286c7b05cecde9bea0a0d39740e

SHA1
144d97afe83738177a2dbe43994f14ec11e44b53

SHA256
983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824

SHA512
8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0

Download Submit
C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_

Filesize
20KB

MD5
00bf35778a90f9dfa68ce0d1a032d9b5

SHA1
de6a3d102de9a186e1585be14b49390dcb9605d6

SHA256
cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2

SHA512
342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

Download Submit
C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_

Filesize
23B

MD5
836dd6b25a8902af48cd52738b675e4b

SHA1
449347c06a872bedf311046bca8d316bfba3830b

SHA256
6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64

SHA512
6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

Filesize
4KB

MD5
0340d1a0bbdb8f3017d2326f4e351e0a

SHA1
90d078e9f732794db5b0ffeb781a1f2ed2966139

SHA256
0fcd7ae491b467858f2a8745c5ecdd55451399778c2119517ee686d1f264b544

SHA512
9d23e020875ed35825169a6542512ec2ffdb349472a12eb1e59ddc635e57c8fd65fa919873821e35c755aa7d027c9a62d3d0fa617340449d7b2c4cf8dd707e93

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

Filesize
6KB

MD5
4c81277a127e3d65fb5065f518ffe9c2

SHA1
253264b9b56e5bac0714d5be6cade09ae74c2a3a

SHA256
76a6bd74194efd819d33802decdfddaae893069d7000e44944dda05022cfa6d9

SHA512
be077b61f3b6d56a1f4d24957deaf18d2dff699bda6569604aac4f1edb57c3cfd0abc5e2a67809f72e31a90b4aed0813536c153886da2099376964c60e56001a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

Filesize
4KB

MD5
2158881817b9163bf0fd4724d549aed4

SHA1
c500f2e8f47a11129114ee4f19524aee8fecc502

SHA256
650a265dffdc5dc50200bb82d56f416a3a423eecc08c962cfd1ba2d40a1ff3f7

SHA512
f3594aad9d6c50254f690c903f078a5b7a58c33bd418abdad711ebb74cfbdb5564679593e08fb2d4378faaf4160d45e3d276ba1aa8a174ed77a5791bcac46f28

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

Filesize
4KB

MD5
03b664bd98485425c21cdf83bc358703

SHA1
0a31dcfeb1957e0b00b87c2305400d004a9a5bdb

SHA256
fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115

SHA512
4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

Filesize
4KB

MD5
31a29061e51e245f74bb26d103c666ad

SHA1
271e26240db3ba0dcffc10866ccfcfa1c33cf1cc

SHA256
56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192

SHA512
f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

Filesize
4KB

MD5
da6cd2483ad8a21e8356e63d036df55b

SHA1
0e808a400facec559e6fbab960a7bdfaab4c6b04

SHA256
ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6

SHA512
06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

Filesize
4KB

MD5
9e62fc923c65bfc3f40aaf6ec4fd1010

SHA1
8f76faff18bd64696683c2a7a04d16aac1ef7e61

SHA256
8ff0f3cbdf28102ff037b9cda90590e4b66e1e654b90f9aea2cd5364494d02b7

SHA512
c8ff15373b37e848e6239a82424569e77c82a5fc557d17e7d2ed1d0d2b2f7d026cc1e2bc98cb5ee945c02cfefb82803c23fa6a26f48ff0adcf762f94cd5dd035

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

Filesize
4KB

MD5
10c429eb58b4274af6b6ef08f376d46c

SHA1
af1e049ddb9f875c609b0f9a38651fc1867b50d3

SHA256
a1f6ba57ee41e009d904905c0ce5e75a59ee6790e08542561303109e1faafa13

SHA512
d8760f61760bffd8671b727d386ae220e7e6e68829a01553cfd5eb60ef8bd1d7c1b25e7b17a6db5bd17ba6712ef44999726764459318e784843c73bc4facaf46

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

Filesize
4KB

MD5
5c026fd6072a7c5cf31c75818cddedec

SHA1
341aa1df1d034e6f0a7dff88d37c9f11a716cae6

SHA256
0828572e4fa00c186dbf1d9072a6154d65cb499c6a37e338f3305f77a2fee382

SHA512
f9d28714b2a05f8d9025f1692e4d7e8baa6daf6176353f65646a38814a242ef2adededa44419edd69f10cf96ffba506dab7cb6e52111457bf69cffef12174b12

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

Filesize
6KB

MD5
189ba063d1481528cbd6e0c4afc3abaa

SHA1
40bdd169fcc59928c69eea74fd7e057096b33092

SHA256
c0a7a1df442ac080668762df795c72aa322e9d415c41bd0a4c676a4dc0551695

SHA512
ce59ad9b17bab4de1254e92ce4fe7d8c8242832f62ab382e8f54199a9932cd11b5800cc33895441426373d5210cc74104e0271b721a7e26ed400b716ae4d5903

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

Filesize
4KB

MD5
18aaaf5ffcdd21b1b34291e812d83063

SHA1
aa9c7ae8d51e947582db493f0fd1d9941880429f

SHA256
1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5

SHA512
4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_indonesian.txt

Filesize
4KB

MD5
1514d082b672b372cdfb8dd85c3437f1

SHA1
336a01192edb76ae6501d6974b3b6f0c05ea223a

SHA256
3b3c5c615fd82070cc951ab482d3de8cb12df0b3df59fbd11f9d3271fa2fbca4

SHA512
4d41c945ce7c94746875b0dbceb14811d4966de4e97fe047406a304162fde7e1e2a16367fc2e43978e2e5aa66749f036b4444aa2312673c2cc3af296e8b77f55

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt

Filesize
4KB

MD5
8958371646901eac40807eeb2f346382

SHA1
55fb07b48a3e354f7556d7edb75144635a850903

SHA256
b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585

SHA512
14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt

Filesize
5KB

MD5
7e1d15fc9ba66a868c5c6cb1c2822f83

SHA1
bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7

SHA256
fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265

SHA512
0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt

Filesize
4KB

MD5
202b825d0ef72096b82db255c4e747fa

SHA1
3a3265e5bbaa1d1b774195a3858f29cea75c9e75

SHA256
3d1399f5323a3ece1b1a8b3b31f8fd7f50c3bd319ab3f1c38c6e347452c95314

SHA512
e8fc7cc09f431301d22a07b238179ee053505090e3c4db30ead061513fe7159f1fe8b80efc93f4597fe00f01087bbe0bb2231e13693d72c8def138657cb91566

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt

Filesize
4KB

MD5
7913f3f33839e3af9e10455df69866c2

SHA1
15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25

SHA256
05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c

SHA512
534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt

Filesize
4KB

MD5
58e0fcbee3cca4ef61b97928cfe89535

SHA1
1297e3af3ca9e4fe3cc5db78ebbfa642e8a2c57b

SHA256
c084a68b65d507eb831831aa2ab9afb9536cb99a840d248cc155ff87fad18425

SHA512
99aff0c481e34cd0e4fcbb2af471afb56d91aa11be664462b08e17ae169ca03ef77e7063b4ecd0f38ca7b2f6dc0bf2e316c7b31dffbbcfc763cd8fae27dc78d2

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt

Filesize
4KB

MD5
9b0b0e82f753cc115d87c7199885ad1b

SHA1
5743a4ab58684c1f154f84895d87f000b4e98021

SHA256
0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32

SHA512
b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt

Filesize
4KB

MD5
eb8926608c5933f05a3f0090e551b15d

SHA1
a1012904d440c0e74dad336eac8793ac110f78f8

SHA256
2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04

SHA512
9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt

Filesize
4KB

MD5
6367f43ea3780c4ee166454f5936b1a8

SHA1
027a2c24c8320458c49cd78053f586cb4d94ee6f

SHA256
f8d1972e75a320344e3c834ba0a3a6a86edb39e20ef706bda9b7965d440d1998

SHA512
31aab33e0d272cb43a8c160b3d37256716a683e5052192fd0e4d3cdaf30a10a9afa9d26d5d14ad216ee455627c32892a711d2bc137ee7a7df9a297f001a19e32

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt

Filesize
6KB

MD5
e04ad6c236b6c61fc53e2cb57ced87e8

SHA1
e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4

SHA256
08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e

SHA512
0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt

Filesize
4KB

MD5
56dcf7b68f70826262a6ffaffe6b1c49

SHA1
12e4272ba0e4eabc610670cdc6941f942da1eb6a

SHA256
948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f

SHA512
c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt

Filesize
4KB

MD5
66456d2b1085446a9f2dbd9e4632754b

SHA1
8da6248b57e5c2970d853b8d21373772a34b1c28

SHA256
c4f821a4903c4e7faea2931c7fb1cf261eba06a9840c78fdca689f5c784c06c4

SHA512
196c2282ba13715709ece706c9219fe70c05dd295840082e7d901b9e5592e74b1bb556782181cdbe35bd1ab0d6197fef67258b09491fabc6f27606dbed667d49

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt

Filesize
4KB

MD5
b2248784049e1af0c690be2af13a4ef3

SHA1
aec7461fa46b7f6d00ff308aa9d19c39b934c595

SHA256
4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690

SHA512
f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt

Filesize
4KB

MD5
194a73f900a3283da4caa6c09fefcb08

SHA1
a7a8005ca77b9f5d9791cb66fcdf6579763b2abb

SHA256
5e4f2de5ee98d5d76f5d76fb925417d6668fba08e89f7240f923f3378e3e66f6

SHA512
25842535c165d48f4cf4fa7fd06818ec5585cc3719eff933f5776a842713d7adb5667c3b9b1a122a1152450e797535fc7a8e97ebdd31c14b4d4900a33ede01f3

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt

Filesize
7KB

MD5
53f7e8ac1affb04bf132c2ca818eb01e

SHA1
bffc3e111761e4dc514c6398a07ffce8555697f6

SHA256
488294b7faff720dc3ab5a72e0607761484c678b96d6bcd6aad9ee2388356a83

SHA512
c2e79c2505a6fd075df113ffce92ad42c146424ca39087601daa4ed15a2b5528d478a093921d9d8a738c7b6b963275a0693ebe526b6e2135d14ced03639d0e70

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt

Filesize
4KB

MD5
29f9a5ab4adfae371bf980b82de2cb57

SHA1
6f7ef52a09b99868dd7230f513630ffe473eddf8

SHA256
711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f

SHA512
543fe63f791250e05e8fda24fd2ceadebb4c8925e8927de49ae490895c87eed3e61a9ad50237532649f99fe3165836261de215ee3f66ffbfc6d677ddeea7732a

Download Submit
C:\Program Files (x86)\Steam\resource\filter_banned_english_cached.txt

Filesize
1KB

MD5
009ca439b8e68dbdb83850d51b07c736

SHA1
b8dd1986d15aef3dcba09c954577c780b549c582

SHA256
4bfbbfd0114ee78d7795835c64aae6dc6b525547748c5dd1150d7d1ff8757c43

SHA512
25e90b8b737b30879ec9073457cc7b30bdc46ed71b8885ce14f9c1946476d65c6bbdd0ddc19bb09c406cd9439837aec5c8ad007dbb5a4378842e1634429b093e

Download Submit
C:\Program Files (x86)\Steam\resource\filter_banned_english_cached_timestamp.txt

Filesize
29B

MD5
e7bb25aab01b728baecaf64f097f8928

SHA1
c538ef85973820ede513fd8003120e65d95c06a9

SHA256
f527d5ebf2601380f9be77abbcecfbb20a9d02d0ee420a86aebb240dd0fe9403

SHA512
60e5c2d4d2a007eb1339825347aeade62e41af8a106564ea421311b355a0cf18f565300b85580859a96ecb1f1be156670aaa257ba631e82d886479cf8518b1c3

Download Submit
C:\Program Files (x86)\Steam\resource\filter_profanity_english_cached.txt

Filesize
2KB

MD5
597a022be713f9c4a5bf3c3355b2349e

SHA1
daa98c451fcd353629fa8a475d74a172699f8a4a

SHA256
6f08519304e2ecfbd3d554cd5bf3b7b2658b55c70042ac5064ce04d0bacda5af

SHA512
f1da1d40abc2e59667d93dce4b5dda1fe7eb9258e1fc307cb461ce3733e9bad322703e2e0da7ac915ecc403a8ad4633b79dbe4e1e50985e53fa4844248a6a91a

Download Submit
C:\Program Files (x86)\Steam\resource\filter_profanity_english_cached_timestamp.txt

Filesize
29B

MD5
db7d8fcfdccbbeb8ddf2224532e376dc

SHA1
5c0e13ab1d89ca38a9f0c9a0e7cb354421fac25f

SHA256
6cd39adf390c89d6e11baed4f82123a03f1aacc7e3543ac9ff0f4cfac03cd49c

SHA512
d6e67b5618b347e1f1353b725663d104bd210f8f6e7e706a1fb99587ad61838e8e3bae256d82b5db889c480bb4ae12857b7b17ea899c3302c49ddada1f41aa5a

Download Submit
C:\Program Files (x86)\Steam\steamapps\appmanifest_1533390.acf

Filesize
658B

MD5
9131662a7f8aa63d2ef29c414a863113

SHA1
9cc356aacbb80bb7b072d5b4dba41efeaecc0f23

SHA256
d4b107fc3f57c378c99e1b77d2756c13ad7882488d84b0f311e28cce8a50af55

SHA512
87012aeca74b7306da14fa53c4b856803713f9c5e56aa12c35d95685fc348539e3ae50a129f24d7a3b86697f36fc491bafef3c8e794a2dee9b79a370dbf0f78a

Download Submit
C:\Program Files (x86)\Steam\steamapps\appmanifest_1533390.acf

Filesize
797B

MD5
b160b280381d2ae60fa7cdbbb67f7158

SHA1
871ebc271cd1bf244d308d01bd56b496079b9846

SHA256
97ce0c37f0cd7bf6f1a09c0ee8d37e74040931e67f15e31eddd126eaed040d55

SHA512
5671d1f451ced30a89df39185e1fcb1f73117b56657edbfcc9068ee9186504301a81dc21038e04d022d6536ce8a656022263eaba9ab695eb37c350c0e6c79967

Download Submit
C:\Program Files (x86)\Steam\steamapps\appmanifest_1533390.acf

Filesize
811B

MD5
e549613645df27fb8976b58a3e3403c9

SHA1
4a44756d94963fcd584809d985e8f478340a58f3

SHA256
bb2c4b273a5c99a297d75f86a530ea42327b6cefd987285304a7c37bac1051c9

SHA512
c462ad52ce9e4d23234f9b2302ede61e18e2263ddb3898d25836efbc12cf05516fab6429e080810df51d6142cae212bc4142479d9b58986f2187b5a0a73d551f

Download Submit
C:\Program Files (x86)\Steam\steamapps\appmanifest_1533390.acf

Filesize
802B

MD5
9370e9ece2d773435a3927e00b6c263a

SHA1
4c87c4ea6527e238bfc5e21db01178ff7a8e1000

SHA256
c5b8e6421060c62f9949a144631554bf22406dbea765f20f59053acebd9d2fe6

SHA512
eeeeafb8b7da0e15fbce705f399b052f3ff001aa5b8cb2aaa5e7d2f0d842bbf04b94306e37184e21c741fc6447b91fc3e982044475d8c9d356ce9f5a3104a86e

Download Submit
C:\Program Files (x86)\Steam\steamapps\appmanifest_1533390.acf

Filesize
811B

MD5
af410c5dcc3704373890556fefd34998

SHA1
08936a8df6ef85b9c2eb4472d5ad048dcae9a51f

SHA256
6c83fefb22a726fdbb008fc5a9e2b8192a189dadf740a42d70f578c3b57c9866

SHA512
a405f518a5185fa014b2692730f40b3959e185b97d7cdb6ad3fb1e91cffe34c90a449f9275c5296178457b42f47968973f184fb2d89a0961ddb90418f8082057

Download Submit
C:\Program Files (x86)\Steam\steamapps\appmanifest_1533390.acf

Filesize
811B

MD5
5e3636182cb9ba63bd7c9fbdf45d7ed7

SHA1
1fb55b0f186af34389c3b4ba3d0aaded796eefbe

SHA256
5586d7136bbbb9a65006a927f0ad3d2238c242ae1f0a00efae3ab2a85e1d3b0b

SHA512
af26ee8d83160376ac6cce1c86bbd4163d356d5622e6832049e6f6fff6d54b384e006e2cd2fa91cffd68d30a57fbdf34ce66750f175973a21ebfa867048bc9ed

Download Submit
C:\Program Files (x86)\Steam\steamapps\appmanifest_1533390.acf~RFe67cebc.TMP

Filesize
631B

MD5
8468fd6c28d7100616885fd1dfdf24f5

SHA1
c71c124d8ae89046ade2d89a0549aee05df25c2e

SHA256
38665e9eb8fbaedf3735fe4cf7878112f9a7c3f588e1fc9e9b19d2655c8f84d1

SHA512
88cd370b4241268d9d3697afa3aac9affb49a04dd8ec8a5eb8f5fe7ff567eee1209b6f737544c19766355ec0ba83fbe8ba46a368551bd67aec59f03dc73f8255

Download Submit
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag.exe

Filesize
651KB

MD5
96f469bc1ad1ffe1a66fd2f0339a57a3

SHA1
6e0559a8ce322a795c1cd8787967c0f6dd09e804

SHA256
27fb5aa684dda1deaef7735d18d9df92c616cd9216d47f7a050293194c97176f

SHA512
b36bca90a78c9d18c9fa944c844e8992f02b353750b1f63760b44d9eae036dde507ed492f6f798f3870ba5692461b9f5a5da9e439eb903b8fb15344e7fe554ab

Download Submit
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\Managed\Assembly-CSharp.dll

Filesize
3.3MB

MD5
e150dbd24a7a605e9ab0b0e19295559f

SHA1
bc01946fd6984b381f3f99976d7201519e8625eb

SHA256
b6c418dd881b375a379dd150f43c986b6147c9c7f635a18d99d713015164863b

SHA512
1d2babe99c99819b53dbb3415c63c0d3808823671ebf3b538bb7a2ccd607fe76fa8f499d037df283ca5c9baf8d518a189c84c6674659bd778dc7b937bab507e5

Download Submit
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\Managed\System.Xml.dll

Filesize
3.0MB

MD5
4ff4259287cfa6cb88bf0e1273b1bf4b

SHA1
5ca1e645efc89ae43bad495aa255850f61c9aa38

SHA256
a4a4819f960b4988bd12239a711c8d5efc3f4aceb3b106eb3f50f5c861fb7624

SHA512
704c135ae57acb2d3431aa8d7f36e8c32abe0759bde2927cc2b740fed45d61016daf47b414d7322464ad2018f979c6c1dcb73e2498bff69f37ad1fa97b593f10

Download Submit
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\Managed\System.dll

Filesize
2.5MB

MD5
483e06fdc7185f11a853072de70bfcb1

SHA1
4b8811663413db7512694e4ec260c8ba93623f6d

SHA256
1c1c0adb5ac52e6e54f80dd9129ed2c336009413c88df3aa605f10a08b65d147

SHA512
9ca38a0787ea970fd72085e44c70cbf972e24515cff6b345c68d5015cbcfd1a49b90c2795187fa9e98622517231e3480b54a81abd656c95f07e7ca4191c30c3a

Download Submit
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\Managed\Unity.InputSystem.dll

Filesize
1.0MB

MD5
fe2a7d70aba67ed769954c05bb57ffb4

SHA1
44ff84a8ace212174b2df5d71ddc9fd1fcfa277e

SHA256
0e9eb772a12106269a92106fd8a1ff5ee1cfefd784fd7b4fbf4a25fca5c4bea0

SHA512
0b7e773c256d9b413aa49abefa0b4eddec397d9f730fde1d8372f4c45f12f4f3ed5513d43a841d2060db8de37fc9d0430e4cc5780f02291411a14ffadeb9ab0d

Download Submit
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\Managed\geometry3Sharp.dll

Filesize
1.3MB

MD5
6335f195f206980705a34c6340392ea4

SHA1
bbbbea29e0d57c9ab034099512a9a36708ca51c5

SHA256
d9a6f7514e88be8e8bc8819892aa243dfd0f5c9b08e9e5f865232fcf26fd7c92

SHA512
df2071af6299b053cb5083b89d784a6db6851c8f0a4efdc5ec2add96b9d1dbaee21bdfa51a7c2517a0da5744ec61d0da73dc4abb5d704398d36d5465214da899

Download Submit
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\Managed\mscorlib.dll

Filesize
4.4MB

MD5
87f93aecf04f9e65205ade77353afb68

SHA1
1ae268e275d60d08a9a5bc61305654c35eacefb0

SHA256
7533eaf81e6442f0b61c338070e639cf36590d2e1fc27bf038cdee30320bdd46

SHA512
2e704762eeb8c08af814b7f839d91bf38aef5560f40edf43f2f56069012481bc8a58fc5baaa4663352872df1f670f2e993655563a200c3eaefc56dc87f1fd624

Download Submit
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\Plugins\x86_64\OVRLipSync.dll

Filesize
28.4MB

MD5
ab671f950aeed2788d4bab2eabe7034b

SHA1
784796baea1c643e468a462debae2e3d5ceccb6d

SHA256
2318c42eb806753e340b426d0b83dd3278f5b8d3b851ccf90a5be0ea8e1d2cd3

SHA512
e4c6c2ca248f580720462751894f194feb42f906f8ebd4f8783edbe1f23a643b3d93fdf97dad5bb2f0219b5c73b0060a20f4a4b4e93dc93ac64689d524d64885

Download Submit
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\Resources\unity default resources

Filesize
1.5MB

MD5
fb63e360ae25d04c5c63008ecec35f85

SHA1
c797653e8ceb2dfaae48a1a46df4bafa65ea4ba7

SHA256
cb225fa67e0caed63330fa6544efe8a994a51eb1fb30f8419cf53a5267772610

SHA512
280d44493ab8a2b2587fab58bba19b7f029755d1305352e5055dbb73d3f809694af34f4b550db39425489a2aeaedfb468c932c3b9d8847842269e2a8a3f3a29c

Download Submit
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\level0.resS

Filesize
30.7MB

MD5
47338ee01483aa60fc2522e4540a8e8a

SHA1
69cab169937bf23d3efeec709aa82539aa56413b

SHA256
66aba57c6af5dfaada8ee5ebe58a661905d02101e97d0563a0e53ec61d08c1b4

SHA512
13e34bee430a4313f2d3850c0c43a9e2acc0d04db3cd962e082c1f8d4ba0df62c412eea01e43e61cb60523c17a8a7925bfbf87ded27a90182a0e4be24478fbfd

Download Submit
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\level11

Filesize
2.5MB

MD5
7c6e555207926e8fc4d3de8c67eda914

SHA1
2d7337d98478b58518020872e038888bd665cb37

SHA256
98d702355bc953a6887c58c162d068785d77ad99af180cd9690d3df8abb342a8

SHA512
5674d457130357d2fdb2214f74f84c6b483edc817c445b7927817e7028fdd4b364c05a6105baf4509122f20f1b746cc540c8c0754b9318dc7c6d3224bef22cc9

Download Submit
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\level6

Filesize
14.4MB

MD5
b7635e12936cf27ecf539b4e14d19176

SHA1
662c2ef1af710e916365e5c6a1e777e3ac32d75f

SHA256
719e147d7460f608d8f35958ba235209ece721c61c6b44744b6ab8f836ea02dd

SHA512
1dca0e87f07744ec9dc56b46f55b33667e191363e000c79593d84ef7a6a96c5613f704e4516e2a92cd0c822365e23b60ffeda5b475b1aa3290482d342ec331fc

Download Submit
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\level8

Filesize
14.8MB

MD5
bd23df53336695f1f29f49f91370f833

SHA1
dcee2c4a616bb8401bdab30f062bc11afe4faefe

SHA256
b32c2ad6b972cab860c22e62eee058af3ddcf1570ef12c182439e5ae5daec7fe

SHA512
ae99d53e187eec51d127ddfd829b9d780eef755f8a64046cce7c41bf94179d523e681a119c459c5e7820e8e5bc83910843dfa4bb7a06553eb7c4a6faadd8feef

Download Submit
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\level9

Filesize
6.5MB

MD5
830febaf207526f8b35f7f445491a56b

SHA1
c79f789af686377c53aaeea7ec9ef1fb3c33ba5a

SHA256
8232e0d9bc37c73e344636e6ef7aa0a93b2b6740353b191ad71cccdb00489281

SHA512
4a689e556d4ba115619caee191e978d877c156efd60b10fb44d6035ee574bc373f4c96822b39b4f7b418d63de0075c6e4be1873e39d2064d4809781e5f639cbb

Download Submit
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\Gorilla Tag_Data\resources.resource

Filesize
4.2MB

MD5
26780a077e4e348c26eddb44fc69f8b6

SHA1
4ce68971a268a803e04427eb9c0bf7388a96f5b5

SHA256
564d80a595163e092caefc4591ee7abad694e53ab6f1e0d7b15ac3640f13a6a8

SHA512
4d21572a506919e8e91aaa7cb388b1b1377a692075f1b0eceecef077714a7a96aece4defd2b1f20f80b8653fd99a53f623ed4289694f78b6eec2b9d0ac20ada8

Download Submit
C:\Program Files (x86)\Steam\steamapps\common\Gorilla Tag\UnityCrashHandler64.exe

Filesize
1.1MB

MD5
8d8b0c1ce7c59096c84938eb2127bc06

SHA1
b73017e6aa8f90916e5bc1f9d1477e33c10261e9

SHA256
598587247f628861d542143885749e3c139e91ed35563ed9eb278b2684039213

SHA512
5b7c27a6d9fcca72079fa12f392429386734fa7756b85103cc0b9940a0f5b2af5a1100b873a871436a08b0ad1622c12af76cf70efada1952cca42155060bec33

Download Submit
C:\Program Files (x86)\Steam\steamapps\downloading\1533390\Gorilla Tag_Data\StreamingAssets\SteamVR\bindings_knuckles.json

Filesize
8KB

MD5
d32b798d7e5324382b0b009578544f32

SHA1
b01716d2042abc32f468a1f3216d222a8381c118

SHA256
0d30305d54c080dbfd634c1db6f2111851c3a1102ce71182657a072593d0b04f

SHA512
bdeeec7417e06354452aa2f66dd5283812cc503f12dfd6fd4617e227459b6436e006383d2c77fbaf12f064cdf65b3763e4e09863cbaf30f2b5adaf517885b45c

Download Submit
C:\Program Files (x86)\Steam\steamapps\downloading\1533390\Gorilla Tag_Data\level6.resS

Filesize
14.4MB

MD5
ed21b571ee11ea42db335c38256a4276

SHA1
81c7c1eb07d91ab93d4203adc865b2d96df7f079

SHA256
a8a7f12f877973c51375373ffcda492852e26c6271cbd75786760addf8cf0b9d

SHA512
81bf2e997c73a89a43373232a365aaa5e35e5707af142dbea32535ee9e8e1b655536ae089faacc5cd21ae22bf80213538368171a1d4d73aa435e6bf11dbd2c83

Download Submit
C:\Program Files (x86)\Steam\steamapps\downloading\1533390\Gorilla Tag_Data\level7

Filesize
4.2MB

MD5
1bcc924cf846fd47f62ce4fe4cd53a5d

SHA1
0565b8595aa754d1e1c4f3ac11fc76d207a9e578

SHA256
e64fabd9b80f13b6dfd52fcb5a99a17768813bfecca1363f6ba40e18045c2140

SHA512
5cdc2766a7f107ff526e6a3c6d1bcc08da6f3b3367cf0c3d950d503c3bd78557c0b044c4dc9f83d85c8eeb6c63466bef22658705c8c68f94bcce771ee656b320

Download Submit
C:\Program Files (x86)\Steam\steamapps\downloading\1533390\Gorilla Tag_Data\level9.resS

Filesize
13.0MB

MD5
eabea138dba9e92eee056599388b4531

SHA1
445aeb583ab37f71fe572ca65715fc8d98214562

SHA256
4ef012d2fedf3fca48b5a7116cfaadd53f1b4f385182a71140950551036ad384

SHA512
05289932c2ef22e34d600686f371a67e5f45f51dea0aca8656c370cac5a9fe93dfb3dc1d7fa81741357fa95480fc7c2488fa5d8e3a07a76d248569147d50e3fe

Download Submit
C:\Program Files (x86)\Steam\steamapps\downloading\1533390\MonoBleedingEdge\etc\mono\4.0\DefaultWsdlHelpGenerator.aspx

Filesize
59KB

MD5
f7be9f1841ff92f9d4040aed832e0c79

SHA1
b3e4b508aab3cf201c06892713b43ddb0c43b7ae

SHA256
751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a

SHA512
380e97f7c17ee0fdf6177ed65f6e30de662a33a8a727d9f1874e9f26bd573434c3dedd655b47a21b998d32aaa72a0566df37e901fd6c618854039d5e0cbef3f5

Download Submit
C:\Program Files (x86)\Steam\steamapps\downloading\1533390\MonoBleedingEdge\etc\mono\4.0\settings.map

Filesize
2KB

MD5
ba17ade8a8e3ee221377534c8136f617

SHA1
8e17e2aec423a8e6fb43e8cbe6215040217bb8a3

SHA256
ce1db1ad8a9512073164e3eccdc193f7eda036e1a9733caec4635de21b2865c8

SHA512
c18bcbcbd4b9a20a72b1a934d70db1eafef047f34f3ba2c6357d8e3afed07ecaab861e5571ceb58c22d4d3e5ebb34b51e366a0553c3153fbc263d1d80472e297

Download Submit
C:\Program Files (x86)\Steam\steamapps\downloading\1533390\MonoBleedingEdge\etc\mono\4.5\Browsers\Compat.browser

Filesize
1KB

MD5
0d831c1264b5b32a39fa347de368fe48

SHA1
187dff516f9448e63ea5078190b3347922c4b3eb

SHA256
8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741

SHA512
4b7549eda1f8ed2c4533d056b62ca5030445393f9c6003e5ee47301ff7f44b4bd5022b74d54f571aa890b6e4593c6eded1a881500ac5ba2a720dc0ff280300af

Download Submit
C:\Program Files (x86)\Steam\steamapps\downloading\1533390\MonoBleedingEdge\etc\mono\4.5\web.config

Filesize
18KB

MD5
5075af18fe1d2b5f9555d5cc68029814

SHA1
56c4c47501664bc3bcd54be505cc3d9f7d0761f5

SHA256
c4cbddd4fd9347b58cc5a72b36dc4ba1ad2bb699e65869d05cd3fb9865f0d824

SHA512
dfe8ed72b013e67c3cf0622cfe7d14ffde97a4d7132ca6690db5cf2d347f3535b475119b01984923ff6c3f39b8865f857c67ed465c3b0358e2fd06bb0dae0909

Download Submit
C:\Program Files (x86)\Steam\steamapps\libraryfolders.vdf

Filesize
231B

MD5
de48bddab0503d227bc78ae5016e7a47

SHA1
beb08aa9df31ec655a10dcbafe256e60831b8037

SHA256
d6fbd2632e91966eeb3be9599841c87ee59a7fb49e1f0159681a44141d3057dc

SHA512
e8613419667b1dfae14c9e3c67a461be93e332b67446659cc4d855ff2e1868629061b63b9cf6cadb1989da7fd824aa73366a500d1c5b8821c4204c295b83af82

Download Submit
C:\Program Files (x86)\Steam\steamapps\libraryfolders.vdf

Filesize
276B

MD5
8796a2e55824f458d2bb2a7a9a8d48ab

SHA1
5b8e6a93d956b07fd3cbab3cf8e58f9f786d933e

SHA256
5afc3be62f742d33a2d6ad0cd275b164e2d9cbe6442f9b3e050da10030f3a584

SHA512
878eae0fa31bc94a8238e10f00b9e7f1cf65756cacc13afbe1d7bb1397cee12e50968bbb8714a06c8705166f0a2625eb9e9c993371538868b4c2a7ae8242f584

Download Submit
C:\Program Files (x86)\Steam\steamapps\libraryfolders.vdf

Filesize
267B

MD5
6bc3cc40c786bba7238e614f2241fcd2

SHA1
4f3aa40c28170b87520dc29d3ae3aa2e1a0149ca

SHA256
e343f5a5c22220c36461e2a01720b18e588435c60a14893a2f10c13a4f18c613

SHA512
d6d4990d800e647b8cfa403d375dbabb406a1ab7b407b65d844de212d6616287d59c5e7d4c2e31d42bcd170e65315929c0c7dc41088bb4b1f7a6762d051381da

Download Submit
C:\Program Files (x86)\Steam\userdata\1337093349\7\remote\serverbrowser_hist.vdf

Filesize
1KB

MD5
df6beefa83a5c79d646e8a39886d76d3

SHA1
2290e4364d7e2176a59f37919b6a2726bbd0e451

SHA256
eed3a753c6c2b1e916409b241d5cbde25992fc4893046e3aa6334c0afcbde3aa

SHA512
6508873fa7450fabef7bb11e308eaa17da87360d1416eec56eae409653da4cb25d4af8ac81acc7ed60ad77c327fe17c0c6738a5ca084e7c9584a572c0af790e8

Download Submit
C:\Program Files (x86)\Steam\userdata\1337093349\7\remote\sharedconfig.vdf

Filesize
164B

MD5
ff97735309d032b7d4ba30adbee40452

SHA1
715667964ed328b052c44e868e7bd7789c99c9f9

SHA256
abdad193023424404e3eb087461bd6af29bac0cc41184eb067057c566cb63898

SHA512
240a70f3d1181be5e51a2bfc99b07052d087bf5d450b73fd2bc4b93028a4015b0e5b522950c1a182b29685b506efbc36953b337a4e2f9acc2d9e3405402d1a07

Download Submit
C:\Program Files (x86)\Steam\userdata\1337093349\7\remote\sharedconfig.vdf

Filesize
230B

MD5
e342c45eaa0b73974cd1fa767d444887

SHA1
f468860cb7ade3127b9a92350495b9b55a1b3fcf

SHA256
7059016c8cd662e202cba143c0069f0d9c5b81bde9262aa36d5d8c789e3c0594

SHA512
3c131d7abb903b4a7a60b79195a438b564e9dc3d28034673283d883866e1b8b6fd76921753b0378f8e5fde38c474b69aac49a551a85f62ff2c55de706e2de53b

Download Submit
C:\Program Files (x86)\Steam\userdata\1337093349\config\librarycache\1533390.json

Filesize
126B

MD5
5216ef382c2d09e344ae46f2c073acab

SHA1
91040770b2b51d00e6b7c32a37315eef249a55bd

SHA256
2200afe5bd5dccc0cfe9d34b29eedc49014dd673e5b9b2d1797e3f52a14b5617

SHA512
0a5bc2a98fec77d33e0aca0934d547746883d5ce2b6cfe23e36dc9afe5fbd51dfe12d955213cd0123b4ca004e225182bea6722d0870ea65ba5a808756e893f7a

Download Submit
C:\Program Files (x86)\Steam\userdata\1337093349\config\librarycache\1533390.json

Filesize
2KB

MD5
13ffba0b5a5cf62973d2ecf079ae5752

SHA1
76fe58384a68f3d9b090a119372c744667309c63

SHA256
f1994d01070a0f8d6cda05cc3bc63cf69f07a5dbfe84fb9db41e8ccb99ccae8d

SHA512
d2f7332cb4d1d60331d0b57b796be4abdd3940d5f7e0200d3dd18ff454d4dc6ac5dd9dd158738c0c6f8200c1597048a2a7681b8eec370b23165b9404117462c6

Download Submit
C:\Program Files (x86)\Steam\userdata\1337093349\config\librarycache\1677740.json

Filesize
4KB

MD5
bc229b53b58b73365ee6fc8478b5672f

SHA1
65fe155e66e0e9179c4d160b9a037309a1e1b8a8

SHA256
7472ea879b117c27b17e4a61924b8addd4f506be73f8cd256652c12c82dfbdfa

SHA512
ed2a15cfb476f7bf03d50301565709aa2d7c7edb62a559f9d684c59256bf9156a96c48ac1019b6abba2e9717999bec655a33a89f670103c46bf6063b50648154

Download Submit
C:\Program Files (x86)\Steam\userdata\1337093349\config\licensecache.async6696.tmp

Filesize
331B

MD5
ce5cf1b85a3f314c7b54d5d0582cc46f

SHA1
b3e8a5ecc195930af9dcb1dc8a70f0e3c0e207a2

SHA256
87dc88fb93d2e2b63e9fc8a3f052d235aab366d47cb9a0ba342489bbf737d933

SHA512
555e99783fdab77914ea3e99c06e1543ba1e7e35a4c1566abfd36b206f270d2f5a174f9e169894f1c8cc0e4fa7aa79f1b72d5e9ac41a81c77b2011609c5a63a2

Download Submit
C:\Program Files (x86)\Steam\userdata\1337093349\config\localconfig.vdf

Filesize
3KB

MD5
eec615e3562d0dd89053fec396312a50

SHA1
adeaaf65799c9ae3e0a6d18bc5f1e0c1921e071b

SHA256
0df27495417e77b1efa3d791a5f272131990d649c20d8cd9113a7445488ce186

SHA512
cb6d862dadd5d68bcb3afa1a3de533925f55e4007d0e3dd50ce399703feacc841d7639feb418c566f8f0b47a4850480e2ce983fb00d9a64a0846f110fa01c5cf

Download Submit
C:\Program Files (x86)\Steam\userdata\1337093349\config\localconfig.vdf

Filesize
25KB

MD5
4edeef63bf1075c26e938dbe8ab621aa

SHA1
c6e2410d5b07badd064853ce377f02b2014a0b5a

SHA256
74f2a28658667a0b265c0f0d3e6b6377d9e3fa0bac419141192cbbaab1ed957b

SHA512
a4a449eb0ebbaebb4e7650e98b9f1b7eb2dd7af27452941db3aebc23b07a42545e8bb94574be8331876ecf35798737689ef5b2fe97004807f7042b5d0237ff80

Download Submit
C:\Program Files (x86)\Steam\userdata\1337093349\config\localconfig.vdf

Filesize
32KB

MD5
4cce21b2271a1ff1571083fc9882da5f

SHA1
d019016e5f89abaae27092a36937a07d65da0fbd

SHA256
725865bd7a8a2ed9675b8167690a352373c5bade23a098da698575de44b84cd7

SHA512
c44465ddaf1940a67ca05987732486f1798998c6fb2bbe27f0a7adf7997c5bec84aec6da2a0ce6f77790f2dec1ccc046ebd084f7ae576459074b3f159b7d6ffa

Download Submit
C:\Program Files (x86)\Steam\userdata\1337093349\config\localconfig.vdf

Filesize
3KB

MD5
e8fda022895b03132a1efce33f521b7b

SHA1
0ca873ec2223326ed21c7b3a999c59a9750419cf

SHA256
9c0a9eb92dd0d282285d572a6ce696c98ba68e0c0db1e36c6debcea88ba86344

SHA512
067151a6ac0ca14a20f8b30299401ec40c6e9fb262ab19254b2270fa7c34da01a928d7f8c2a7e509472aaff9a8c5b936cd48fae637a1cbce82676c112cad12ab

Download Submit
C:\Program Files (x86)\Steam\userdata\1337093349\config\localconfig.vdf

Filesize
31KB

MD5
ccb023e5b63095350bcb17afbdd1cfe1

SHA1
b4bdb28b7ba25f5384525738cd0b8dc7d06f791a

SHA256
3f60d6ae76e438452740191315e374f2dd24e27ff93929306c86c04707bab0ed

SHA512
d6f6d01c09000de5385f093d4809a24b78b486ce96f93d5b442b2a4d89eb17efe196846be433e8fd9d0ff2dce3a1c7e3f721b6d407e36f7d0c059c42bce3d1e8

Download Submit
C:\Program Files (x86)\Steam\userdata\1337093349\config\localconfig.vdf

Filesize
4KB

MD5
ef47d8471b1461a5ae2d5aca5a909d22

SHA1
b3b949c7c142d589329c82d340fe6ab926ed09ca

SHA256
46d6d198bb24d5dba771f5a9e1bdd25d3fcc93acb591cbcd6006147662997716

SHA512
22d131d58d599c83ac33195f6537ca4abb971e2a2a114bc29a983f52c223f03f4004c18f1f4fe35941b7032706b6bc08ea3560411d3bfdcdb384c905cf7be607

Download Submit
C:\Program Files (x86)\Steam\userdata\1337093349\config\localconfig.vdf

Filesize
32KB

MD5
3a462fbb5810e6b567fdf02be9f72f4f

SHA1
95cfc657b714e287657fc1a30de00401b4303b23

SHA256
60adde96f2f4818d1180396ce0547a734a2f1bfe83ac2409068980b65dd30aa8

SHA512
97445dd33cbf9033c7a1fc9495e8274990e67b7ba006a2710ce8d473f262a41c2a16c7d8f6c37f0b7f27f58dd23d0ded426f51efe47405b32bdbcbc6de5d38de

Download Submit
C:\Program Files (x86)\Steam\userdata\1337093349\config\localconfig.vdf

Filesize
32KB

MD5
a8651df39f50ff11576b55b530b6afb4

SHA1
a2e8aa0642ff0fea8e51d7d6ac47c76b4c32e203

SHA256
21a3659a39bee202f1231de30a86118d176028cf88ea41e2044d00b78053e044

SHA512
df40988769ec850a4866a19243f141686d39583c0b9cca678105801f7bec7a92bb920bd4a4f89894778cb1d52e9d950b644a511fbb60cefcd6d04d0863ad2149

Download Submit
C:\Program Files (x86)\Steam\userdata\1337093349\config\localconfig.vdf~RFe6789c4.TMP

Filesize
235B

MD5
d21c340c3e6a2542acf2dc956b5641be

SHA1
c8157df39d2046a46c83a92dcc13a5ac7a18eeba

SHA256
723dfc0c6d946fab14e2f7d6532893438c8e103935d62f205555066292ab030e

SHA512
0e7b371b6301de3c178c32b7689b1f3a4bf136c072aacd3e189235150a0603faf1d9ba0d4ab5012a236ce62cca79afe7cc65904706998d4fb6a753145b8922c5

Download Submit
C:\Program Files (x86)\Steam\userdata\1337093349\gamerecordings\gamerecording.pb

Filesize
45B

MD5
b06d09e8d81ee1b21a9873ea0389b389

SHA1
e21d7d075610708046fb986ff4bfc58481883f4e

SHA256
6c019e4959fbbe42a192c159f18b596a6dfd4a314a732ea29173e139b39e0c08

SHA512
0afac85cb9d5ff349d286389c71b45ad304cdd31eaf92604052363fe5d171b1521e35fcc1f998478135a419de5f3d63d6ab8b270152a2a29b5eedc860c76d808

Download Submit
C:\Program Files (x86)\Steam\userdata\1337093349\gamerecordings\gamerecording.pb~RFe698574.TMP

Filesize
45B

MD5
253b9348ad98a1578da46bf176c1fd54

SHA1
405e40446e84ee5f029316cbec90e81330d722fc

SHA256
9e24f0b247713705632e77c9e99d453acd00961e3217f53b00b1d3eaa1cdc61e

SHA512
b42effcbaf40a7ca4243ca0e1b819f47a82b2e2c002de496cb08356e1e8710dc7602eda082dc7e354a8b755ce4204392fb1b807a3b268f2d380f9795010b3689

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1496_1114241320\LICENSE

Filesize
473B

MD5
f6719687bed7403612eaed0b191eb4a9

SHA1
dd03919750e45507743bd089a659e8efcefa7af1

SHA256
afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59

SHA512
dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56

Download Submit
C:\Program Files\chrome_Unpacker_BeginUnzipping1496_1114241320\manifest.json

Filesize
1001B

MD5
2ff237adbc218a4934a8b361bcd3428e

SHA1
efad279269d9372dcf9c65b8527792e2e9e6ca7d

SHA256
25a702dd5389cc7b077c6b4e06c1fad9bdea74a9c37453388986d093c277d827

SHA512
bafd91699019ab756adf13633b825d9d9bae374ca146e8c05abc70c931d491d421268a6e6549a8d284782898bc6eb99e3017fbe3a98e09cd3dfecad19f95e542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
f58b46c1f63f69cccdd03211546fe50c

SHA1
a3345e17593bf8fd2649af4a61fedb900f6877ca

SHA256
26bdb6e9a16209da8ce8541aac0f56f3f69d56417c1ab0e3d8fffd9a6df45e0e

SHA512
d53d36746d8e9ed1581d11e51d7b57a8dbdf31c057152e7b76ba96c0c7b46fea4a6e7ebc3e514c9193026c55e26dab25b762a34c27a7779e238578721ef17b5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f7ba6d82912882be455e6fb10b242e65

SHA1
23734b54593b9c081095935b957a632e4d624295

SHA256
f445227ce7c25e189a7d033685a71c1dd0289025f914ec2afa4a2cbdb7a06572

SHA512
a45add310d40531c444a41471a08b9525dab519c3d9b6c649272955a47179f8173f0688558c22ff9fc2a7ce3abd02c38206c28692ce3c4c324b394564ffecf47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
539B

MD5
e5c5778db24739463adbdb282190f5de

SHA1
09aaa69ff07e12557b2b5d015bf58919a213f892

SHA256
812b26fa27b18a28576c527fe1b4fd5de12c54e21d880b43953ace3d0058c3ab

SHA512
d0c3a6894fd5d89c24baeaf7dcd6d0445f493ead465068003c897fe18904e8635b5d0882c2b1fdfe0283889cf934c356b73802cdf03b0d3d873e2a9108aa6f05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8575d975a3ed4c529606e60883197b3b

SHA1
2f2be965ee1b3985a66aa7899fe5d8d74bc3cbdf

SHA256
1f7c68d046045c4d6a8b32a2a28ca7d30411ece140f96714acee2dcb4c4295a1

SHA512
441cc86404e16cc8f8f14ad922bdc77024fec135fc15573b5c4079eef7deb323ccf8bd135cf6a8ccbe6b73763abbfdd392665167ef6ac7039f4116466fce4bd0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
06aa452262f56fd1f960e6b904522fab

SHA1
d413a2bd7d4c79f983b047dd1a0bc926e87fd58c

SHA256
16cf16a168eaf960da943357382aed96a29add416ee2390b1ea6ade6f9849dd9

SHA512
1a2a380d7b9e49b97beaa32386aeede7be8b50998c1fe1b2027d8bcd57a3f25d8a13009d9360045ae883138b7eadabc14d630037fb18c7376861e9567dd77cb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ea09e05d17e7e164314cd35860723e25

SHA1
772b4f1936b0868c5fe8127d42c154858c8b295b

SHA256
509a79dc5318804471d3776c91d7285772c72d341dbe0be38e463878631131b8

SHA512
718fe54f10382863321f1b86a5bdb56aa2ea0dbf28f35c069332b6045fb6603678933bbe1a9f8b06c839e1f466b523d1b563c31cbb7a4ee8d799632b1a749eaf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
247bae09732bcac8f65838eddfea0fcd

SHA1
ee92ddd2c984c68498efda9223cf864cbd5ba9a1

SHA256
4825694d078dad7f4cf46169f41e93c3df826177fbb1d39285dcc1bd9c9235ab

SHA512
1a276a7d7263c0db740a4768b7341108a50a72cfc9fe3454981a38791d30bf087efe003a0b9d159f8a3657b34c2c8fe62c8e1f19a2a437259da71c797f3523fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5a6aefbe8e79f0128773b394a0b7db2e

SHA1
236fa8a4cd952d47eee5c9341c127103cae45953

SHA256
c69e8f06bde2b944802e450fed29f01cdb462d71a856c2a6f023709122bb3eda

SHA512
a93fa87817bc888dd1aa290198d1e8d565915a3839846b9ad4fc7ffc71fce6141e301faef278d189e270fabaa05fa20400d1e8438a5fd5eb7f6434c5fdaab6fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2210a813fca84fda8d69745c1e777a7f

SHA1
a2a236ec746c2223ab584654da654beadcc89276

SHA256
38c9e22c35aa79aaf96e3f1867116a86084563921645a586f8998777216c22cc

SHA512
b44191e9d45ea537f679a58dafaba36fb2743a922848fabe641d1bd0b5d515cb2f7db99a21a18d253b0af9b3ba6912ebfebaab090fb42f24b0d3c84139016d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
70857b8398195339918b1a60e0ae2625

SHA1
7cda66eeff2ffb59b7db2926f4241a1d7af63794

SHA256
a4df1efa3dc7c50d334f075de93bb34baa24eaa8caf140db849b4ea2d27d3e1d

SHA512
364cbeb02de76750e72bcb53203cf906fbff262dba88b057e78b8095b189824e65de555231b1d3d973809e1cb6ee940ed3adfd60b5fc198ebbf9aeb86388bf93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5cf2b6a780fc1e4381cd5c730dcd686a

SHA1
f67283a06c63a68ffefdede9d2e30d661b0b818b

SHA256
dd38573195a1b0c11a57a02ab02247e940b9fe8c33b3b542755b1aaa36a46ee0

SHA512
c56886a61c723fbb05f1ddbffb43fc245c6123793d7a1cfe0de56155a8911f49a515f8771452a199a73dfd4aa450b4dae3de4d7c70417bcaa1bbce6e9ee15de8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e6df81e80d9282bf8288a6f5d2d66986

SHA1
e954c07f344d1d55a25570d52c266b2094eed7d3

SHA256
ba4bf438f3000a2ca6482065805e37a093579eb58d3c89c9bcd466dcda7888be

SHA512
55a42d8e772f8109ecfa2e1bde024f0fa92076f753fe98dc66a81ed1ed6e97cc3236449e21e3b3ab3ff7c05c91bb6edfae7abc849fc72b16b486399cc88c87ef

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000002

Filesize
19KB

MD5
6b831f3db51767ddc21f287180bc828c

SHA1
218035edf4f39635f755a25341d6f0ce5fbe6a65

SHA256
ee2a079993d679fed7cdba20f20eacab7466cb6c35e8ff9106a409c6b2a68a08

SHA512
4bbc07b86590429b903385a5af76cd62aa2f1b0e130d0a2816f587e2819f76ceed88af1089f172851d7a505a9e2a97938fb220c33c5b024839f2cfeaf5da51a1

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000003

Filesize
24KB

MD5
b201e8da90ef456598b8b3bb0e31bf53

SHA1
8bb524c8e9b17920c83d9a06c0b305e41cfca560

SHA256
2c8b630d1edafb8cc8c8cd73fff10c8ab6d06232929a4d458ec34628920f1665

SHA512
50126ac5b7800f5a848ef49ebc8e71d78cb5ee9c1602486b30e697ce57af32c868e46795ac2c157cdfd7fe65c03133c7a752813d520a9106adc3e50620b473f3

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000004

Filesize
40KB

MD5
0c9f37673dd9c878a4b5bb419ee24b5d

SHA1
d973a8e073c1f76068f0947d495998f7f823d76e

SHA256
c1e12f630e7f356d154ffe4a7a3873e7e136e41c1c37e6c0fa4d2c52f1d269dd

SHA512
b361afedb4a910b12f7dd7b5b33d2914be39528bf4d1486661d0107c24135cff3a5393df1af85cd7d1551f0e601ea9d2ad4b147e56f469691e2b11906fd1514c

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000005

Filesize
32KB

MD5
31b05e57c066452d73ab005bb42865f7

SHA1
2a8efd5d7753dd756c539ad66831b01f603fb13c

SHA256
84d0be622ddeef6d0793df5d274965d6d13a756979b4b484185dc7a051eb4071

SHA512
f793863cec23493b58311d37720fe7d48e21c92da5cbc9c5d4562e47a046e33be4584d58a1c031513298c55a9c33f5e591fd5ce831c9c33af9c2594bb071c277

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000006

Filesize
36KB

MD5
9d69a62bc96e67bf779bae3744a8f693

SHA1
bd8a95a103317e66551c2129fe392998dc45c7ad

SHA256
39ee252af15a86d1d4d54a5c3fb9ed2678ef2ecae9ad9d711290acce7a7a611e

SHA512
e1fe5393201c37a9c34196fb986e818d5a94545009c6536b3c6b1a1bf71d528d458039ef1f30eb1c064e233b7238b72f7cd69d204827ba8cdf3f783aa012ca10

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000007

Filesize
19KB

MD5
48ffef4fc267c7350a37339001bd1a02

SHA1
9379041d4d542c116b420d014c7ebb68137a008a

SHA256
254467e453cf3cae3c70085b41462cd71b233c247b5e212f444347537b4c4873

SHA512
34b459dde39b3056e2f0a4c593b342d32829c9eebb2b01f146aefa0d54f0b52ecf4954873cf76b424abb25f84370d0b5ac06fdac734b397a7444b4b64b4d52f6

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000008

Filesize
19KB

MD5
280188959917fc5a7ce9cbca5ba6fc05

SHA1
f651c19d05fb115f031342f12b36337d866c0034

SHA256
430750b0cb0ab5213be051d447bd370fa4afb2c0ca0275cd4f1beb8e0bec8f15

SHA512
fd0c1159142cfe42617bdfff51613aa6f72119e35d21bd1ef01a76697cbb8ecfff6059e52e8218be0e2fa37389a7e5582f5d6e9e0d80c2b00602337be5125eab

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000009

Filesize
150KB

MD5
52344bfd16b4f6d1dc61922468458ce0

SHA1
142e9ec2e44f56e7e97f243624655decd4ee75ca

SHA256
d4636d2d08503bfd82c4e2a614efaac77ed9aaa38793703e16cf8f73b445aefa

SHA512
4bdf08a37c220abdb1ff30a30b10573082960ea9ad4118d3a9abe3e0334aefbcbe07eb60cf17d9f8f4539c5f719a67c803a452a4e79ab64e71e7c7b83c0de172

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00000a

Filesize
268KB

MD5
0bef1003dc5bf34496bf96ed5e244795

SHA1
08c366df05fbc5942aa9b3a85f2daad3ee1af4ae

SHA256
1c187915a32372c936a5d3930b914c5583350653ee52ecfe0c90128dd5d86839

SHA512
936a64cc0eeb507b6c62218f6bd96988b7b8d8a4e9e5307e0e08f05d79cd16ccfd2b57f8f3c4abc97a818883e38b0c2b6f477a1fad6b6619ff4feb384b847138

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000023

Filesize
19KB

MD5
361a99bb9125f15c3ee59a8d274d61f3

SHA1
9d888aef6e15209c5c1cfa6456d278744eeea7ae

SHA256
bf1484bc2185ba28dc777ddf0b3e51e97e51c6638a3a4aaf2d357eecab91dda4

SHA512
e35e9a8fb6e76560901038fc9d42a770f452c60de86e862bcfbe5d0ab2b0097e02ee33ab25ff4bce803003a4fd72059405f86d13ec07e187980a21fa1a4bda9c

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
a5c555fe02df2eeeca6240eacd962eb0

SHA1
ff6839c6bb0dd88a8cbce5a3732cb93273cf1328

SHA256
9478cefb9dac8cb3a531fbbf134aa993964f0467ab67432b657722e8c2e0d9a2

SHA512
14213a1e9fb0ac92842442685aadd879a341827d030fe82b209c7d154fd02a694b2fbd27ccc742455604db802756466e8edf0d5f22570e85de8969bab3c324a9

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
888B

MD5
3f36cf132bc3ae4654557b1c9bb5ddbc

SHA1
4d33cc41e3ea59a769db29e4deb0d325e67901da

SHA256
d92e0ff9c30f52ce218582dcae20c7a5ce685138c832c7311074302d97249b1e

SHA512
f22f4538961f7a81e914676bcc612446562ceeea0aa9a93b8886c61a8d9939eb87e4e44102d793267c2768ac0655fc6c1704f06088cde36017ff5bc5b9523e55

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c7b12a2b6eb4c2816b1f962addcc8b0a

SHA1
a3f67a612f9cd599a19e2461779a70b0fea3c4bd

SHA256
af0f32d2225b77c8f495933bf01029ff6585c521976b52675de1e6b44336c537

SHA512
4e5ef20ee11d9607a1b5451c59f14b4f4cd85f29216ea5bfbeb9694c338eae2baf710685ad69805eb26c12eda1aa4c548ffecc3f7cdb4faa179624dd60ccfeaa

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
04016c15b7b6471d13b6d06d688f505b

SHA1
b5e3400137f04a7d649e5200fcfe777024af0549

SHA256
f6fd6d2d8410b57076ffa3b73aee0cf0a56015eb876e99f347a7da87f42db6c4

SHA512
ef392d77523c1e8206254fa6f4fc972e1d4bbe01d514eb53bda49a88a9f3e485b160ade5fce706c604db6e8eb993cb7a3b84f733a37d89b69d7176adea68d731

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Dictionaries\en-US-10-1.bdic

Filesize
441KB

MD5
4604e676a0a7d18770853919e24ec465

SHA1
415ef3b2ca0851e00ebaf0d6c9f6213c561ac98f

SHA256
a075b01d9b015c616511a9e87da77da3d9881621db32f584e4606ddabf1c1100

SHA512
3d89c21f20772a8bebdb70b29c42fca2f6bffcda49dff9d5644f3f3910b7c710a5c20154a7af5134c9c7a8624a1251b5e56ced9351d87463f31bed8188eb0774

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

Filesize
718B

MD5
f08485948faf3cdea203d02aac5c4314

SHA1
7010d7fa390349b78b323c20790583b962998ee1

SHA256
0fd6ea1091ec11bfaadee67741660d3fe9295c8204b2116e13c02909f0e36cc6

SHA512
270bb63e9884dc7e3bf56c7f4f5b780a0d707e70e8b373c7e820f9e930238dacb568508e323faf56a7e432c7e3a795d72ad38f75294d65d5ef83c963c960157d

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

Filesize
830B

MD5
0267c5148ad149ef0be44c8e540007e6

SHA1
9f586154bd9b42c0a27f8522edef49137d7f9b34

SHA256
c4f5682352d3f086bb5f052c8bf1b40039a458c2fa2cb2e9c7286d9866482bd7

SHA512
690373b2267ca1f8b101c285110c250384494eacfea86e16f4d514b3c1e9eba5e7eb5393d9bd120d9a2a5f992e792129622fcce7b91086bd27219d11849a202c

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

Filesize
830B

MD5
60ca031a8e490e02e24f8b423164c1f7

SHA1
0f289608b023881f0dd5ef3e25b76ebc42a7696f

SHA256
f69b7e88f649a41ce10accf371db36c4123ca7925580c2e9646d3db9f02a8156

SHA512
92e1cce10d1bbf18eebef9a18c61d9fc8f6c1b6fbb76d28b7f5a06159a6d76c265ea6ff551902446a1bc5e8e7ed724dadc12059b51d358f037434dbf32b28da9

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json~RFe675d83.TMP

Filesize
529B

MD5
e5ab0e3a78cb9fedd0afa15938c783ce

SHA1
5078740fc529743b6c726241227f83a95644af51

SHA256
3f19a80361debc5b4a1430b442b81d6111384881fe930914e0abb87127689196

SHA512
22672f945a1cc1144159a7c0ebc6c197bc5ba75efaa4d3c42915dd8f56c113fb107562dc46842f5f436993ad86454e3603b024e9fb0e1f8e6febdedc2b6f552a

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

Filesize
687B

MD5
3bba40bb65bf344d9eb2679d5ba5e3ad

SHA1
1adf0db803bf934a837a5cf679a257a6e0390222

SHA256
26a0fd2481bc36e2c9cf410d26f62dd27e2fc74de8529dc28de4741a0048ea95

SHA512
c3a14bff20bc1ef50f757de4517fe631d6d3df8ad39c5fe1dfc3cbee0f86e02372c7f212a9b8da54c65e01e3d61659f76f0b5d9082bf7b73600693494854ecaa

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

Filesize
1KB

MD5
39728f69878a965cf43c69a33be806cd

SHA1
9568aff6a5ee24dc6c417541a8fede0294b72546

SHA256
4138fd21a5aa1ccf8eb82093a18138b4e0119b73230d74ba6d54d4535d21fb83

SHA512
88dd197fdb1260944addbd215434a77365fe52edb645948ac02827b110ef35ca079b8c3394bcb12e0471484f64e247c420e18827aca6d1b5ac34d5afc9267ada

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

Filesize
1KB

MD5
9dbbc3831c1caeb6c42796fff2bdb974

SHA1
0df0adfca398d69e756bed1fec36f46dc4686750

SHA256
053660e61571d3e16b4170ef1f3faa54908396dacc56f92e07e0af39bc75ac7d

SHA512
4f5cc2ce31dcc561429e77e4706de43c37ca530f9f7bab6fc44aab5389c366d3def9286ee9e7a9649f055c468f942606c6b02a113061614e7590ad01c38baeb2

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

Filesize
1KB

MD5
bd53b8401e561b422f60db378df7dd94

SHA1
c8dbbccdec1da52dbef36283ce1104f063126a03

SHA256
20206e332900552c993cdcca6211d70e2eeb048fdead1e78adc9b3fb4c697211

SHA512
e562a19cd2521b2d9017870654ba66c656c008e222b7efebc61e155dceaa40c5e1a92fe436fa8ca08407d3acab7c4a76977e082941c952b52a12bdb86655a713

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State~RFe6770fc.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

Filesize
524B

MD5
91a011c8971aff5924d4244ec7bc8c45

SHA1
0048d581435797eb7f0bda3dbb9d67b61f22dd89

SHA256
6c207f84892af31b6c3daf5c9678563562d9e14b56a19b8a8b21a609698287b6

SHA512
41b0399e8c6a6af7ee337c639891bf0080f1c15c8ae16b3fc9de9eeee9638698d1ca28587b116ade7c6ab7cccf50ac775725e15ec933ce6cf9a1890109266228

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

Filesize
524B

MD5
000a03eed808c1a03a8a833e05651408

SHA1
7eba431140592ede71fc13e94bf82496f4e7c344

SHA256
18471730f0ff7f37b279b3ff9c75ab7ea758137dd8fb3598dabf0d5b4eec977d

SHA512
12ac23d6deb7358c170a83e60de51c6d9c162fd19cd5423741472899c6e20054f81157043ba4eb11ccb3b18195bc097b503274f213f8efd39c99c1b3025f8ef2

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

Filesize
188B

MD5
c83a5b924afe9d054af38d6821a6538a

SHA1
eebc6c020cce637a59280e2492fcbe62b79d3078

SHA256
98099149a10026c999a3c1c3f8399311133505820799783a70264ffc150616fe

SHA512
e7d0dfc0299cc2def0edd908bb76b0ac07de9f8fc5e72fb59a8652ce94b662c4fcf8690668263a680061e62cf8f8ad2be1870b3ffc27b42edd8721780750ae75

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

Filesize
524B

MD5
b7bf632e10ac172b996857961e779522

SHA1
8265628226dece02e3fa7fddd53206ba369cce24

SHA256
2bcdd0cc2ae5dd4993fa07bb928beb71d140262a3049456fc699b39a6e2cda41

SHA512
48094d0fe7ecb791fb0da8b84c03fa710a0510e55ef04a52b738a6e3f883756ec18d335dda03bfb0de29e6bee0b9e19b88845e2ea944f448523e7c7690937c01

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity

Filesize
524B

MD5
86cbdfb44155cba824bfd320432d48e9

SHA1
c44d0d7c92bba39bb7ab7d1fe10befdca025c55e

SHA256
f85c6680031ca04eee2da4cf1a43274aa34b7250dc172de326b9d0bd7ed7e16b

SHA512
896960b9d4c70a7fb2f1030a80e858bbe3ae60052c2da49bc0593af35ae35c48390ca98734e1b0dfe5fd1a2b1643036fbaa8723f68603bcc39495fb9ab1e2fd1

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity~RFe66f1e9.TMP

Filesize
188B

MD5
163465cbe501c9a76cd0097bc403c36e

SHA1
531f59d6c7447065e2d7416ce590cd7a8d49f872

SHA256
280d32794275955f352ac0c071262911490dffa97612c0e323f1fa4185b849b8

SHA512
7c3a07556742896fa49826d72d7546bc739b1d16a84c828cd5d26f158c7a748a971a03fb7c3f5cfd05c6267847f75a287f8400e9ad5c060c850afc303451d23e

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\c083ae15-c4aa-42c8-8f1b-fd1839617772.tmp

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Session Storage\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Shared Dictionary\cache\index-dir\temp-index

Filesize
48B

MD5
1bc6125e73c489590fe00cf3b92ce359

SHA1
24387167fa7aa0417d7106704aaaa0cfacedb9da

SHA256
0a0408a3e956f9b8762730193b0535b1356906572af24e25124475841695327f

SHA512
c679dcf24dc3607a21f7fefa08a7247b722df0543d003563c61c7705a0fce4c231a8700b09ab088fbe4339dbc4077032af0139a489896fec63d67e65b0f193e4

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\UserPrefs.json

Filesize
2KB

MD5
602c49f9246967bdcff45b4f43cf2fb0

SHA1
4c5796e0c724bbd7a9244cc8a0fc9e8f40181f2d

SHA256
a3ad9649c1038078038be1abd591cdba73b4b4f5cf30e11bb6cb7a432b746114

SHA512
2f273c0dd0127071f4c768cfe7277c6efff84c1ef4f4271c1326db3658c84261794b106af3198717f349fbaaaf276163700bbb50ae20fe52ed0a88a192d46f77

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\UserPrefs.json~RFe66f1aa.TMP

Filesize
2KB

MD5
68b20851ccb9834d21fb32615e42bd43

SHA1
88fab935f0b9484994097c08f785e9ecb7d68127

SHA256
a954b528dd65ad6c4c2091fa32f17abdb7a49454ce88e10bb6c377734c70c26f

SHA512
dcb0771120c8fe35213d60e9abf4b242af807324759e3c99e9b2569c00a941d885d53ef6fadfe69e6b740e0b52a6008602605d643801190a2d29175a7d065e15

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslF947.tmp\StdUtils.dll

Filesize
110KB

MD5
db11ab4828b429a987e7682e495c1810

SHA1
29c2c2069c4975c90789dc6d3677b4b650196561

SHA256
c602c44a4d4088dbf5a659f36ba1c3a9d81f8367577de0cb940c0b8afee5c376

SHA512
460d1ccfc0d7180eae4e6f1a326d175fec78a7d6014447a9a79b6df501fa05cd4bd90f8f7a85b7b6a4610e2fa7059e30ae6e17bc828d370e5750de9b40b9ae88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslF947.tmp\System.dll

Filesize
22KB

MD5
a36fbe922ffac9cd85a845d7a813f391

SHA1
f656a613a723cc1b449034d73551b4fcdf0dcf1a

SHA256
fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0

SHA512
1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslF947.tmp\modern-wizard.bmp

Filesize
150KB

MD5
3614a4be6b610f1daf6c801574f161fe

SHA1
6edee98c0084a94caa1fe0124b4c19f42b4e7de6

SHA256
16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b

SHA512
06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslF947.tmp\nsDialogs.dll

Filesize
20KB

MD5
4e5bc4458afa770636f2806ee0a1e999

SHA1
76dcc64af867526f776ab9225e7f4fe076487765

SHA256
91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0

SHA512
b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslF947.tmp\nsExec.dll

Filesize
17KB

MD5
2095af18c696968208315d4328a2b7fe

SHA1
b1b0e70c03724b2941e92c5098cc1fc0f2b51568

SHA256
3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226

SHA512
60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nslF947.tmp\nsProcess.dll

Filesize
15KB

MD5
08072dc900ca0626e8c079b2c5bcfcf3

SHA1
35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37

SHA256
bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8

SHA512
8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
8f9b7f109fd9d138c4a3750534232058

SHA1
167393d8c4f38eea1f2aca9d7335174dfbcedc36

SHA256
a7dd9da6ebd5ea4ac58d2a29950c25064737ff690e143dbc1f46a4592fd1f349

SHA512
c7941aa9f5be45bf38765837863bd9a922440d58f57e8817711249ca38316415e89c8c86e57181c8fe820cd88e5201021bc2bf15d00fd4a616e4c5e178dd5380

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
5d0ccaac40302d5a85f4d01e3adf73ab

SHA1
c174478ef0e3fce105ae86ff0d8ed9ba1de380c1

SHA256
695a4633bc30bb17a872f7ab4b0c0f7da4cd9ab5fc7b6701fe4aa7cb3c80d2a2

SHA512
57dd02e944dd51494b0a98d145c6f8dbb38fa2eb5e6307f05508e17a9d86df7464be39909d956db3058aeecb63ef22d147bf4cabbd7e88903b7147608736512b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
12KB

MD5
ccf895e88c1948eb0cf13cde1f3d05af

SHA1
1b39fda01a029362c323f08d708ad16c5c806886

SHA256
8102f1463541c76bb95d50e0767138ca6c0ccc2398e7994c21aa6d0312eadb3a

SHA512
08de94046456cd1b7db377ea2d1835b9665b9cfd54708047cce38e90e537d8e197601c0dabb00207e850b66bdefe6034ec48e3a2afaa68379bd1e3aec79ba996

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
12KB

MD5
c82765d6b081bf86f93c85ee3c461636

SHA1
17f8bcaa74b4c77756f91ad9adb56564ab287e12

SHA256
9b39adeb9fb95c948281b2ed0f63446ae23b79af68c55870453a77f1fc58a84b

SHA512
f3b7e7f3a8809a49316bcfe283f960fbf9033b11faa0d5582b3237e1192aca35389a856ea5c4e0adb0c0fa89127ed90077611c9d97a45e8f4a90761bc8b6deac

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
6KB

MD5
21b62ad8543163e6b42c2642ff2a1a5e

SHA1
61aa679e204f76a0f28e5471dfc6b0f9573128d0

SHA256
6205798e69c61c568b21c8a81f5883f3726bdc55033f97eabbc2bc75d3dffe63

SHA512
a73e15b018dc339ea9c08fe766af557b0aef6f0f162c061bedd3809d0f54886fc132fcf03d000c45d7a1f34a6a8741506e03c4f3c0323d8da023a3b830cee9db

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
6KB

MD5
6db9afc8640c1b3db497dcfa187570eb

SHA1
383fb8ac2955956fed303b53e8f04348e534fd68

SHA256
05dbb4be4f304b38d863df2b1103aa2115a8f677cda01bf4de6d115eb2968b09

SHA512
df15d596e1a55a6d2dce8947bea04e3192bb260e970c5f1592c5afb0b167d82c967e6e6dd0c0721239fb5f3ad835df70b6e7df22629d40e2df89eb85069081bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
6KB

MD5
6e4bb6feb92bd63015071e63e90850d0

SHA1
768e7acd84e72eb7a1a4430dae44b42ddd9685e7

SHA256
7e2360bef0434620006a75b43db4a18cff3a02951322b9ff6ebd83821c1bcac0

SHA512
fe1606e5d2ba6596107da425c808e9438909357642144ba3b3a3a6cc564eacc7e3ee1ceaa15e552f8c782405b40bd68a4713cb6d6194e082d0cb29df858ef7e7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
12KB

MD5
64b44acac5b57430dd771dd16fdd762e

SHA1
e339ffc6a5830e0e96545321517e8647efb5043f

SHA256
f377cdff148bc3e84a0541cdcdb5eb4859e1ad0136163ae4a4f32446e912e6e5

SHA512
55222e0e1a2733545c54f9079ecf7f0cfc5759687d1ceff7406f70b8f59b75aeebca7f4c67c2f01355531d2864ba7ab87b95b79f9df9d49607e9e2d33bbfce03

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
12KB

MD5
692685d3bf57c8e4e0ae6fb456c36ca5

SHA1
45ad1fdd4ad22ad9fa2102f6f08f218ed0dfe100

SHA256
58cb77226da0919711a416c6c58f00e5b2e932dea4c08b2e961b823f79bdc1f4

SHA512
04788ee1559bd646104f696a0aa1dce33e2d730be94a5ec2119325fd009d68a21dfa84e3480c02e29854c4509d58bc6ee06653ee6f0bb0a925f71a55a9536c66

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
12KB

MD5
13e844e90450190e536da6226935bb3b

SHA1
4256ca6a6145bdb2def527edf7a472545ff5b4f0

SHA256
5f83801d59474ebdee5c4667f6c6dae668e394d776f13baca01877668d46a64e

SHA512
96445f70141c8252fd9cfc3573815d46b082424305243f771e14fae33c97ddd1a9d261ec8c41b138ace55d64fae3a94e81b8978f1a1b95e09e6a7e51737dc9bf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
12KB

MD5
0073380db54b0b5199a100dc74a61356

SHA1
93467b1da65622d65a8bd4862ab842c108249045

SHA256
5021f90bdc890ee355c832a81e4457d17f43b25e9fa9436b78738af43c058fd6

SHA512
45e5cdbcb68c9c648affbf801793c693190835eec2d8c69630bcb09438c54fafe077457c98bb0de9f1bb134c5de01affbc928f5126cfe24c00e6960fbd4e0e13

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
12KB

MD5
db7df3071bd3e1b85c75755129bf9c82

SHA1
a72b2aad73099a1814555b67103a9e40437b8cc2

SHA256
82c4e4689dbe305a5f08a4ec3e4d369c75cd1be6209e1e92f0d9bc699079218e

SHA512
919b43c2898269cab80e996d22fc78ad66230a98d70b611d834aa2ab0ce221094a8da1d22574df190edcd79d93561e8224bd3f21e9daba1328b97d71293a4982

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
12KB

MD5
f9abdfffa380110d4d324aa73584d8ce

SHA1
b967f61a329c0f050c4d7126f137f47dccaade6e

SHA256
9e87c534a8842830707ae3875f5c9dd7f817028a9b79efb36d2353f5150561b5

SHA512
1e5e65a2af862a577df2d2230076dbcf54641f92f5e3c8bb05128183f7ec21b28a6d20e7b5f3420c55e84172450fb45ff0d368e91dc7ce4d6c65bc2fc5860a4e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
12KB

MD5
c4321b4d163c0bbb1761ff1c94d205b2

SHA1
2e745c07373b377d1d1f88bc6d3ff40a809136c1

SHA256
bd12465e68275a5502000bdfd8581eb35da61eb98264115108823f3df52df8b8

SHA512
56db3b3494eea32591d2d1e15dc1ba35bdbdf821a7bb9ed4f0fc8d3d11b736cbbb815bdee04b866f15ab17679816d34b1ebc7716c8219fed5f39dd282bb7b865

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
11KB

MD5
e4017688f7e10f10ef39d26132fdcb35

SHA1
eed65c2874033d7e167925c83050ad539a923673

SHA256
04752b3a80269ad95d10a3db4c808d0ffc3cb649d7273043152a11780b16c5bf

SHA512
bf82549483ae169c135d1f7be0599e1502d19ade6fb3ba2fe434dcc3bf6354d1d6a23b2a1c79e7a660c4800d03defc4f441c55d63eaba9ca4fcf7fa6e68baea0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms

Filesize
12KB

MD5
a2b38d7fd87dd0284cbc4ee35532c290

SHA1
6d2ed9d0c62052bc70ac3448b609258cfbe4cbc5

SHA256
9c665f503fd64a63f8e0cd3d808622ff3bd8c2755477155337122ddd0ffcdb66

SHA512
83ead7213117303b41dc42cf6044242f5812b76eef172223b4098a08ad99c673d00802ab3c5b229472b8a1b82442fd63604489c431ea96440ed53bd8a4132fdd

Download Submit
C:\Users\Admin\Desktop\Gorilla Tag.url

Filesize
223B

MD5
0edd7935e18f6a56a5aad9ec573f35c6

SHA1
e8859db177459c92de4bbfaaa466fd595be10d9e

SHA256
ff940374eaeafdab29da38404b6cad3d559c989435f5d5fcab118351c991af2d

SHA512
97f022dcbd6a5ddbfbf942353e82ee1104586dad257972a9f98702e23b84cf5889bb927da7fb41649fc50e10d8114c977eadfa8d0b95cc3b2aba2da8f87efa67

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 537757.crdownload

Filesize
2.3MB

MD5
1b54b70beef8eb240db31718e8f7eb5d

SHA1
da5995070737ec655824c92622333c489eb6bce4

SHA256
7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb

SHA512
fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb

Download Submit
memory/1432-767-0x000001F34F280000-0x000001F34F281000-memory.dmp

Filesize
4KB

Download
memory/1432-770-0x000001F34F280000-0x000001F34F281000-memory.dmp

Filesize
4KB

Download
memory/1432-758-0x000001F34F280000-0x000001F34F281000-memory.dmp

Filesize
4KB

Download
memory/1432-759-0x000001F34F280000-0x000001F34F281000-memory.dmp

Filesize
4KB

Download
memory/1432-760-0x000001F34F280000-0x000001F34F281000-memory.dmp

Filesize
4KB

Download
memory/1432-764-0x000001F34F280000-0x000001F34F281000-memory.dmp

Filesize
4KB

Download
memory/1432-769-0x000001F34F280000-0x000001F34F281000-memory.dmp

Filesize
4KB

Download
memory/1432-768-0x000001F34F280000-0x000001F34F281000-memory.dmp

Filesize
4KB

Download
memory/1432-766-0x000001F34F280000-0x000001F34F281000-memory.dmp

Filesize
4KB

Download
memory/1432-765-0x000001F34F280000-0x000001F34F281000-memory.dmp

Filesize
4KB

Download
memory/2068-12935-0x000000006EA20000-0x000000006FD61000-memory.dmp

Filesize
19.3MB

Download
memory/2068-12959-0x000000006EA20000-0x000000006FD61000-memory.dmp

Filesize
19.3MB

Download
memory/2068-13322-0x000000006EA20000-0x000000006FD61000-memory.dmp

Filesize
19.3MB

Download
memory/2068-12922-0x000000006EA20000-0x000000006FD61000-memory.dmp

Filesize
19.3MB

Download
memory/2068-12982-0x000000006EA20000-0x000000006FD61000-memory.dmp

Filesize
19.3MB

Download
memory/2068-12987-0x000000006EA20000-0x000000006FD61000-memory.dmp

Filesize
19.3MB

Download
memory/2068-13031-0x000000006EA20000-0x000000006FD61000-memory.dmp

Filesize
19.3MB

Download
memory/2068-12951-0x000000006EA20000-0x000000006FD61000-memory.dmp

Filesize
19.3MB

Download
memory/2068-12993-0x000000006EA20000-0x000000006FD61000-memory.dmp

Filesize
19.3MB

Download
memory/2088-12930-0x000001CB1A820000-0x000001CB1A8CD000-memory.dmp

Filesize
692KB

Download
memory/2088-12827-0x00007FFB94560000-0x00007FFB94561000-memory.dmp

Filesize
4KB

Download
memory/2088-12929-0x000001CB19F60000-0x000001CB19FCB000-memory.dmp

Filesize
428KB

Download
memory/2088-12824-0x00007FFB92F10000-0x00007FFB92F11000-memory.dmp

Filesize
4KB

Download
memory/3908-12788-0x00000000004F0000-0x00000000009A2000-memory.dmp

Filesize
4.7MB

Download
memory/3976-12932-0x000001EE83D70000-0x000001EE83E1D000-memory.dmp

Filesize
692KB

Download
memory/3976-12931-0x000001EE83700000-0x000001EE8376B000-memory.dmp

Filesize
428KB

Download