hxxp://yahoo[.]com

Analysis

max time kernel
1799s
max time network
1761s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
26-01-2025 01:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://yahoo.com

Score

8^/10

steam defense_evasion discovery persistence phishing

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
183	4788	msedge.exe

Executes dropped EXE 3 IoCs

pid	Process
4720	SteamSetup.exe
2960	steamservice.exe
852	steam.exe

Loads dropped DLL 8 IoCs

pid	Process
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent"	SteamSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Detected potential entity reuse from brand STEAM. 1 IoCs

phishing steam

flow	pid	Process
175	4788	msedge.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\dumps\settings.dat	steamwebhelper.exe
File opened for modification	C:\Program Files (x86)\Steam\logs\cef_log.txt	steamwebhelper.exe
File created	C:\Program Files (x86)\Steam\config\config.vdf~RFe5ff90f.TMP	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt	SteamSetup.exe
File opened for modification	C:\Program Files (x86)\Steam\logs\bootstrap_log.txt	steam.exe
File opened for modification	C:\Program Files (x86)\Steam\logs\cef_log.txt	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\config\config.vdf~RFe5a322d.TMP	steam.exe
File created	C:\Program Files (x86)\Steam\config\config.vdf~RFe635421.TMP	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt	SteamSetup.exe
File opened for modification	C:\Program Files (x86)\Steam\logs\cef_log.previous.txt	steam.exe
File created	C:\Program Files (x86)\Steam\logs\connection_log.txt	steam.exe
File created	C:\Program Files (x86)\Steam\logs\systemaudiomanager.txt	steam.exe
File created	C:\Program Files (x86)\Steam\logs\controller_ui.txt	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\config\config.vdf~RFe644ff5.TMP	steam.exe
File created	C:\Program Files (x86)\Steam\config\config.vdf~RFe60f512.TMP	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt	SteamSetup.exe
File opened for modification	C:\Program Files (x86)\Steam\config\config.vdf.async2116.tmp	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\logs\systemmanager.txt	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\logs\steamui_html.txt	steam.exe
File created	C:\Program Files (x86)\Steam\config\config.vdf~RFe5b5929.TMP	steam.exe
File created	C:\Program Files (x86)\Steam\config\config.vdf~RFe5d86b7.TMP	steam.exe
File created	C:\Program Files (x86)\Steam\config\config.vdf~RFe674b15.TMP	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Common Files\Steam\steamservice.exe	steamservice.exe
File created	C:\Program Files (x86)\Steam\logs\webhelper_gpu.txt	steamwebhelper.exe
File created	C:\Program Files (x86)\Steam\logs\systemdockmanager.txt	steam.exe
File created	C:\Program Files (x86)\Steam\logs\transport_steamui.txt	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt	SteamSetup.exe
File opened for modification	C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\debug.log	steamwebhelper.exe
File created	C:\Program Files (x86)\Steam\logs\steamui_system.txt	steam.exe
File created	C:\Program Files (x86)\Steam\config\config.vdf~RFe5a49fb.TMP	steam.exe
File created	C:\Program Files (x86)\Steam\Steam.exe	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt	SteamSetup.exe
File opened for modification	C:\Program Files (x86)\Steam\dumps\settings.dat	steamwebhelper.exe
File created	C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\crash_reporter.cfg	steam.exe
File created	C:\Program Files (x86)\Steam\logs\configstore_log.txt	steam.exe
File created	C:\Program Files (x86)\Steam\logs\steamui_update.txt	steam.exe
File created	C:\Program Files (x86)\Steam\config\config.vdf~RFe5eaa67.TMP	steam.exe
File created	C:\Program Files (x86)\Steam\.writable	steam.exe
File opened for modification	C:\Program Files (x86)\Steam\steam-vulkan-crash.sentinel	steam.exe
File created	C:\Program Files (x86)\Steam\config\config.vdf~RFe5c6a89.TMP	steam.exe
File created	C:\Program Files (x86)\Steam\logs\webhelper.txt	steamwebhelper.exe
File opened for modification	C:\Program Files (x86)\Steam\dumps\metadata	steamwebhelper.exe
File created	C:\Program Files (x86)\Steam\logs\appinfo_log.txt	steam.exe
File created	C:\Program Files (x86)\Steam\logs\transport_client.txt	steam.exe
File created	C:\Program Files (x86)\Steam\config\config.vdf~RFe654cb4.TMP	steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_korean.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt	SteamSetup.exe
File opened for modification	C:\Program Files (x86)\Steam\dumps\settings.dat	steamwebhelper.exe
File created	C:\Program Files (x86)\Steam\logs\systemperfmanager.txt	steam.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2572_1335514636\_platform_specific\win_x64\widevinecdm.dll.sig	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2572_1335514636\_platform_specific\win_x64\widevinecdm.dll	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2572_1335514636\LICENSE	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2572_1335514636\manifest.json	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2572_1335514636\_metadata\verified_contents.json	steamwebhelper.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2572_1335514636\manifest.fingerprint	steamwebhelper.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gldriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vulkandriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steam.exe

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 48 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\steam	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\steam\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\steamlink\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\steam\ = "URL:steam protocol"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4018527317-446799424-2810249686-1000\{B0F108A6-1EBB-499E-AA13-C5C5C07F44AF}	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 847123.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
1388	msedge.exe
1388	msedge.exe
1528	msedge.exe
1528	msedge.exe
2768	identity_helper.exe
2768	identity_helper.exe
2112	msedge.exe
2112	msedge.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
4720	SteamSetup.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
500	msedge.exe
2116	steam.exe
2116	steam.exe
2116	steam.exe
2116	steam.exe
2756	steamerrorreporter64.exe
2756	steamerrorreporter64.exe
2116	steam.exe
2116	steam.exe
2116	steam.exe
2116	steam.exe
2116	steam.exe
2116	steam.exe
6072	msedge.exe
924	msedge.exe
924	msedge.exe
1844	steamwebhelper.exe
1844	steamwebhelper.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2116	steam.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 35 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: 33	5872	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5872	AUDIODG.EXE
Token: SeSecurityPrivilege	2960	steamservice.exe
Token: SeSecurityPrivilege	2960	steamservice.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe
Token: SeShutdownPrivilege	2572	steamwebhelper.exe
Token: SeCreatePagefilePrivilege	2572	steamwebhelper.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe
2572	steamwebhelper.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4720	SteamSetup.exe
2960	steamservice.exe
2116	steam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 2264	1388	msedge.exe	77
PID 1388 wrote to memory of 2264	1388	msedge.exe	77
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 2636	1388	msedge.exe	78
PID 1388 wrote to memory of 4788	1388	msedge.exe	79
PID 1388 wrote to memory of 4788	1388	msedge.exe	79
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80
PID 1388 wrote to memory of 4336	1388	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://yahoo.com
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffab0813cb8,0x7ffab0813cc8,0x7ffab0813cd8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - Detected potential entity reuse from brand STEAM.
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7652 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7664 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7784 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7952 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8076 /prefetch:1
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8252 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7528 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8580 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8808 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9128 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9096 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9304 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7932 /prefetch:8
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9472 /prefetch:1
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2616 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=9128 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6908 /prefetch:8
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=9496 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaService --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1896,15644651159108208921,1021801274630837453,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4780

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x0000000000000470 0x0000000000000478
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5872

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4772

C:\Users\Admin\Downloads\SteamSetup.exe
"C:\Users\Admin\Downloads\SteamSetup.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4720
- C:\Program Files (x86)\Steam\bin\steamservice.exe
  "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2960

C:\Program Files (x86)\Steam\steam.exe
"C:\Program Files (x86)\Steam\steam.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:852
- C:\Program Files (x86)\Steam\steam.exe
  "C:\Program Files (x86)\Steam\steam.exe"
  2⤵
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2116
- - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=2116" "-buildid=1737514353" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal,ValveFFmpegAllowLowDelayHEVC"
    3⤵
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2572
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1737514353 --initial-client-data=0x298,0x29c,0x2a0,0x294,0x2a4,0x7ffa9d3daf00,0x7ffa9d3daf0c,0x7ffa9d3daf18
      4⤵
      Drops file in Program Files directory
      PID:5536
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1737514353 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1572,i,16468912460775511977,4027884663218349088,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=1576 --mojo-platform-channel-handle=1564 /prefetch:2
      4⤵
      PID:3680
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1737514353 --steamid=0 --field-trial-handle=2156,i,16468912460775511977,4027884663218349088,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2160 --mojo-platform-channel-handle=2152 /prefetch:11
      4⤵
      PID:2724
  - - C:\Program Files (x86)\Steam\steamerrorreporter64.exe
      C:\Program Files (x86)\Steam\steamerrorreporter64.exe -pid=2572
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2756
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1737514353 --steamid=0 --field-trial-handle=2776,i,16468912460775511977,4027884663218349088,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2808 --mojo-platform-channel-handle=2788 /prefetch:13
      4⤵
      PID:1528
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1737514353 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3280,i,16468912460775511977,4027884663218349088,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3284 --mojo-platform-channel-handle=3268 /prefetch:1
      4⤵
      PID:5348
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1737514353 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3844,i,16468912460775511977,4027884663218349088,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3852 --mojo-platform-channel-handle=3860 /prefetch:1
      4⤵
      PID:2420
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1737514353 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4044,i,16468912460775511977,4027884663218349088,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4048 --mojo-platform-channel-handle=4036 /prefetch:1
      4⤵
      PID:2792
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1737514353 --steamid=0 --field-trial-handle=3872,i,16468912460775511977,4027884663218349088,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=4036 --mojo-platform-channel-handle=3880 /prefetch:14
      4⤵
      PID:2060
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1737514353 --steamid=0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4024,i,16468912460775511977,4027884663218349088,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3640 --mojo-platform-channel-handle=3636 /prefetch:10
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1844
- - C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
    .\bin\gldriverquery64.exe
    3⤵
    PID:2488
- - C:\Program Files (x86)\Steam\bin\gldriverquery.exe
    .\bin\gldriverquery.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4760
- - C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
    .\bin\vulkandriverquery64.exe
    3⤵
    PID:5964
- - C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
    .\bin\vulkandriverquery.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Steam\Steam.exe

Filesize
4.2MB

MD5
33bcb1c8975a4063a134a72803e0ca16

SHA1
ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65

SHA256
12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1

SHA512
13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49

Download Submit
C:\Program Files (x86)\Steam\bin\SteamService.exe

Filesize
2.5MB

MD5
ba0ea9249da4ab8f62432617489ae5a6

SHA1
d8873c5dcb6e128c39cf0c423b502821343659a7

SHA256
ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d

SHA512
52958d55b03e1ddc69afc2f1a02f7813199e4b3bf114514c438ab4d10d5ca83b865ba6090550951c0a43b666c6728304009572212444a27a3f5184663f4b0b8b

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
1KB

MD5
6e6a2b18264504cc084caa3ad0bfc6ae

SHA1
b177d719bd3c1bc547d5c97937a584b8b7d57196

SHA256
f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53

SHA512
74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
1KB

MD5
a2ec2e91c3ef8c42e22c4887d032b333

SHA1
e2c738a2e9400535b74e2263c7e7d1ecefe575f2

SHA256
8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3

SHA512
b069d241efb19e09ec8b5e60ef6c43e00d5cc0f774b9340127c2180356dd1964ac625c1afdfaee5f99e72b26f56046fc329aadbbc365b403af765a55e9c9aab3

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
11KB

MD5
45859bf77edd55a5f8c0c33b98a85a90

SHA1
490664162612bed4940d7a3b8f6d092fdb64e269

SHA256
dbe0adfbd25d53359e8273aecbb2f000232c294e96df38db862d069584e945bc

SHA512
6d6fff734400e42d24b87429c14557b061c80c88436d8032aa61a2a32bd4f9944b5b93986fc2e70d7ec5bbf91bfedeb613321d1698a56d76f00c02f80f23beac

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
18KB

MD5
70e53721486d98b681ae2faef783cd19

SHA1
ec0b23e11d2d461f14d48661da8d87d6c67b480e

SHA256
6562b88597484bdb2d9ce30ec885a4e9e8c6f26a849b09c8559c99141fba6273

SHA512
72b2045c9cb819dacb9fb74e3f3b88eb271a30fe550d23fe43cbfb929edc8e2233d2bb9684bea4736d8f722ebb196165699ea92eaba7f59356782205cfec1100

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
18KB

MD5
b0bf7877a2148d34094bee3399f02e2c

SHA1
283fa3a0ab143070529905139515c73db9d8a655

SHA256
c4783d02363ab17e14c92969a48ed7428b7d1cb64fb5ec71e3ce47188dbc8060

SHA512
5945935ef9056e0a91154b7b8982c4c722a5821a0982a0b6d0de3dcaa519482bbbfd393b4ca381a32996020410f5b9ece37061a153d26cf28174995e2c770ba2

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
17KB

MD5
7b6811b0066432af5b12c257b1e037a9

SHA1
fa7b5a67cb8bf9585f9f2ade78b4393ad01a5edc

SHA256
ff0127bc5b4f09a4a24823604accb26ecb05f3be628085d11eca1b14462d88be

SHA512
dc2f98375529e94264d030d572bb72bd48ef5b574382c9483b6a49ada1f062e7d8b946a13f51f2a386641e5856d405165811321e9a06826d5fdc115f3cae7606

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
17KB

MD5
d8312ae598cc5f768fa885ea81fddadd

SHA1
df32b600d798671a9e56af195168926634b5e409

SHA256
2d8403f7b1b43bc61c26a0d440702c1b70c82149bfbf5a09ea941bdc0951699a

SHA512
9ad643b717114f48c8f03857a45d77b1dec65641ea66dbde2df9ce07299fd3ff02d0ab551cd2b90a5a2e6938f5141ad5d678fc5a8d22430c637f5e1eaf7dba61

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
18KB

MD5
af19f8caa2b10811ae65d38fa71d6051

SHA1
b8d912bbf3367654678f3e322429c2789c5b8664

SHA256
9132d243efa186078a572011abcd18cef26071c785c236869435e9c7b751948e

SHA512
719e37d620d0dc09918fe8629d723c2ef8d374bfb05a72555fce857d23fc34aaa74d85b04f20f0c17a04f518e1447d56c02ce93404ca00f9027ccce559ce7f95

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
13KB

MD5
050b55a916a82fd2fde5ef1af8b46e6d

SHA1
fac77a5024070e427f4a52bbd3f235cda9348c95

SHA256
00fd8e8ee9a541a946e2a5725588c3e7f4d582128e1e97a038c824506b9fabe3

SHA512
6fbf0e8382cb276c8c3bffccafd5b160ebd7d94b183e6cee4d712b778acb93aa68bb21adb44f854efd4b7444b2f3346286c4cd0f84b11b83a8440fb295096de7

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
18KB

MD5
7d28087f0b61d6345ef90058ff35e5ac

SHA1
cbc02ed1f101bc925a92018fdcc293c19245831c

SHA256
bbf3410895e2f49c540cbd26ab7c4ef02b8a81277e6f246c20ef2a3263828b0d

SHA512
a9177d32fb3bdeae1da677a4603e9dbe2f0c458d04f60432d19ff35c9a41bb8f4a4b1d43dacb96082f6659ba3524a75214f4088f57f2229f14d04ce5f449395b

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
17KB

MD5
be87a3bd9138b5976e93fa0cd39842a6

SHA1
0ba16438230a7a0c733e87646fd4e1d88cba44a2

SHA256
a2d369ba9bbb9d1c69615bd4871940bb14db61b49a580040a09878b1c550f673

SHA512
c76a600741291ec2e2bb483d480b17a4759ced017ef1d4d4f2693590f6d355c817c6d00b9a06a0b1c6700c1c63186dc569b9b64eeaf9ece7d2ddbf501e8778a3

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
16KB

MD5
045df41b4f09c6997dd51211dffefade

SHA1
4294320e3f994e238092a157c78d731aad8d4b6a

SHA256
cc4ef6cb11edebb23168478fba745e5caba104c3f7962e0774aab97c5a76b0bd

SHA512
f258b497f9a127ea8bec0487651e05f6b16ea029074823057d1263e07daebca5fa978853a51caa0d4035358596d9508e4d12a8202dfaadf95ffc2ec353a4ddd1

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
19KB

MD5
b44699b4259b430590b32e3398e17946

SHA1
feb1cfbca4a182ef19c58f98862d18b97359b064

SHA256
fd23d32e0898ff512369db17255f05a2d0e1241d276031c857dc11e72b3b8baa

SHA512
2da3a641e44b0a044c47d19c805cf52b023278b61ece02d592cbc0088dd847df79349271542f7f702e13b41f8e94639b12c4a7011cea0f97535dad59527a467e

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
19KB

MD5
64f62eb00852db2028b4696e63c76eae

SHA1
81e2bcc069edc029f39ec67cce8e8832fb0ce932

SHA256
25c712096278a978dd14c4077d3902a151f83093026b52fcee757b0c9ca5fc51

SHA512
d9e50f897a919099f2e46b64d73fbd07ba9a5e2a70b7996acc62a35bc76dc7128016322e536cca543ff47eeeb4d4166138a4599016e8b1c6da15d4a63723d3cf

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf

Filesize
16KB

MD5
eea1f76adb87022c8d2596e605b0ed81

SHA1
6ec8c8433fc611c6c79ca57b78f8ac9c56048a75

SHA256
2b9b2fedc699b75d647a48cfce1f7821198da6ac73730736b15bd2dcca2fa92e

SHA512
5ec5ecf02f4e4e570985261142627ec948c34461076cbf63f0e35a451f1a7ab9106584b340a5158672233e0f894119fb4342595359b0aa739743ce5d2525475b

Download Submit
C:\Program Files (x86)\Steam\config\config.vdf~RFe5a322d.TMP

Filesize
184B

MD5
3cdebc58a05cdd75f14e64fb0d971370

SHA1
edf2d4a8a5fc017e29bf9fb218db7dd8b2be84fe

SHA256
661f122934bbc692266940a1fe2e5e51d4d460efb29d75695b8d5241c6e11da7

SHA512
289c40fae5ec1d3dd8b5b00dd93cf9cada2cb5c12bcfefea8c862ddf0a16dced15d6814dad771af9103b3a5d3016d301ee40058edde3fdea30d9767146d11cd6

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

Filesize
4KB

MD5
0340d1a0bbdb8f3017d2326f4e351e0a

SHA1
90d078e9f732794db5b0ffeb781a1f2ed2966139

SHA256
0fcd7ae491b467858f2a8745c5ecdd55451399778c2119517ee686d1f264b544

SHA512
9d23e020875ed35825169a6542512ec2ffdb349472a12eb1e59ddc635e57c8fd65fa919873821e35c755aa7d027c9a62d3d0fa617340449d7b2c4cf8dd707e93

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

Filesize
6KB

MD5
4c81277a127e3d65fb5065f518ffe9c2

SHA1
253264b9b56e5bac0714d5be6cade09ae74c2a3a

SHA256
76a6bd74194efd819d33802decdfddaae893069d7000e44944dda05022cfa6d9

SHA512
be077b61f3b6d56a1f4d24957deaf18d2dff699bda6569604aac4f1edb57c3cfd0abc5e2a67809f72e31a90b4aed0813536c153886da2099376964c60e56001a

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

Filesize
4KB

MD5
2158881817b9163bf0fd4724d549aed4

SHA1
c500f2e8f47a11129114ee4f19524aee8fecc502

SHA256
650a265dffdc5dc50200bb82d56f416a3a423eecc08c962cfd1ba2d40a1ff3f7

SHA512
f3594aad9d6c50254f690c903f078a5b7a58c33bd418abdad711ebb74cfbdb5564679593e08fb2d4378faaf4160d45e3d276ba1aa8a174ed77a5791bcac46f28

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

Filesize
4KB

MD5
03b664bd98485425c21cdf83bc358703

SHA1
0a31dcfeb1957e0b00b87c2305400d004a9a5bdb

SHA256
fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115

SHA512
4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

Filesize
4KB

MD5
31a29061e51e245f74bb26d103c666ad

SHA1
271e26240db3ba0dcffc10866ccfcfa1c33cf1cc

SHA256
56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192

SHA512
f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

Filesize
4KB

MD5
da6cd2483ad8a21e8356e63d036df55b

SHA1
0e808a400facec559e6fbab960a7bdfaab4c6b04

SHA256
ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6

SHA512
06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

Filesize
4KB

MD5
9e62fc923c65bfc3f40aaf6ec4fd1010

SHA1
8f76faff18bd64696683c2a7a04d16aac1ef7e61

SHA256
8ff0f3cbdf28102ff037b9cda90590e4b66e1e654b90f9aea2cd5364494d02b7

SHA512
c8ff15373b37e848e6239a82424569e77c82a5fc557d17e7d2ed1d0d2b2f7d026cc1e2bc98cb5ee945c02cfefb82803c23fa6a26f48ff0adcf762f94cd5dd035

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

Filesize
4KB

MD5
10c429eb58b4274af6b6ef08f376d46c

SHA1
af1e049ddb9f875c609b0f9a38651fc1867b50d3

SHA256
a1f6ba57ee41e009d904905c0ce5e75a59ee6790e08542561303109e1faafa13

SHA512
d8760f61760bffd8671b727d386ae220e7e6e68829a01553cfd5eb60ef8bd1d7c1b25e7b17a6db5bd17ba6712ef44999726764459318e784843c73bc4facaf46

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

Filesize
4KB

MD5
5c026fd6072a7c5cf31c75818cddedec

SHA1
341aa1df1d034e6f0a7dff88d37c9f11a716cae6

SHA256
0828572e4fa00c186dbf1d9072a6154d65cb499c6a37e338f3305f77a2fee382

SHA512
f9d28714b2a05f8d9025f1692e4d7e8baa6daf6176353f65646a38814a242ef2adededa44419edd69f10cf96ffba506dab7cb6e52111457bf69cffef12174b12

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

Filesize
6KB

MD5
189ba063d1481528cbd6e0c4afc3abaa

SHA1
40bdd169fcc59928c69eea74fd7e057096b33092

SHA256
c0a7a1df442ac080668762df795c72aa322e9d415c41bd0a4c676a4dc0551695

SHA512
ce59ad9b17bab4de1254e92ce4fe7d8c8242832f62ab382e8f54199a9932cd11b5800cc33895441426373d5210cc74104e0271b721a7e26ed400b716ae4d5903

Download Submit
C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

Filesize
4KB

MD5
18aaaf5ffcdd21b1b34291e812d83063

SHA1
aa9c7ae8d51e947582db493f0fd1d9941880429f

SHA256
1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5

SHA512
4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
003b92b33b2eb97e6c1a0929121829b8

SHA1
6f18e96c7a2e07fb5a80acb3c9916748fd48827a

SHA256
8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54

SHA512
18005c6c07475e6dd1ec310fe511353381cf0f15d086cf20dc6ed8825c872944185c767f80306e56fec9380804933aa37a8f12c720398b4b3b42cb216b41cf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
051a939f60dced99602add88b5b71f58

SHA1
a71acd61be911ff6ff7e5a9e5965597c8c7c0765

SHA256
2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10

SHA512
a9c72ed43b895089a9e036aba6da96213fedd2f05f0a69ae8d1fa07851ac8263e58af86c7103ce4b4f9cfe92f9c9d0a46085c066a54ce825ef53505fdb988d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
15409a2493a38f2d20291627b3266d9f

SHA1
4dff0c7f9d0cc381dec34d2f7ebf6e36783938ab

SHA256
21531fdd2cacab406baf8b1380d165253d75d99d103007d96d4d98bf99446303

SHA512
0d21df2b30a73e7003d465d9e2987d6c57d45f38cecc0fd8aa409cee7539c103cd8fd33b126aea574f7ed09032adcc8cda4aa533ee33689755c9aac9016ec40a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
4KB

MD5
1dfb046bf8808449d0c5c543ce8bb093

SHA1
4629da7b28fb2282278088630f2f833b5b92d462

SHA256
74212e3d2f0b47abe9b65002bb0d4c0f52f8b7fb7c1c9cbe6719cf50510c2e95

SHA512
dab9f34a359494473c49a12d4b7a68f1c3bf35f1e48752d68de32c8515368c84cf15ff8f3f6fbf15bc390a5917acf1141bcf08e3dade9f7e223ad5d7668a5041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
00b63557e79d7c82c38dae80dc66f0e6

SHA1
0329bac9739a8a0e146d00770d13ad90ab1f19b7

SHA256
ed8f36f8168a1da359a0c5164f5fdef040668ad17f6d1d2e467c486a746e461c

SHA512
b7e0c9463c3e4fb6331e4ab7a8c3074e6e1ef99d8398c671e59bb2a8632f0826601d6f9cfa9b643923126a23e1ae16c07e37eb09b05fe0e033730c12c903589c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
dad6acec5fb728357aaa665fc06c8c9b

SHA1
d80d3a9de363ba224e6f67556084723e0f9fec59

SHA256
20c35c94870404be53303a0e5c3736bc6e1d510e34649d694d2693bc547eefa6

SHA512
6e78fa8402d71f8c098a97ae312514260accf9388fb033534d95066291c4ee427afc23dc30e8be91238d4876dd745d96170958b6629fa81d8fa46861988b3d58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
8KB

MD5
88f94d21b08c6ccc973a2a759c4da103

SHA1
a733a85e27cbabf6421e5e8f8f1a28077ffa4653

SHA256
1071a92ec828db5097b5ba9a7fe4411a5ccaeb55ccb0a1b7c51e7f8ebce84da3

SHA512
82bbd634cb7049a63c888a6b47a7ac022819e86575f63d178042e43157f8e1c1cdae408f01c0c1f573ceeeb190f3a544ff5ab5e15a5cdaabe9fc6fa1a0427931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
e2f3c7e6cc5ee05e894cb984ba755798

SHA1
265301b7e0d9fc630b73a0cf5558c33ab98e872a

SHA256
88d06145f44d4b8b87afea92590aea8480729c2432d43cbcbe614eef4f788d42

SHA512
baf3229e553cf1d964942f97b150b232f3f4071511fadbbf8f896b8ff9274221cf0eb9e7f47afcbbb9f867c3440a27603b4cc01d29b5c8bd3c39ee727e794361

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4764d12948d11a8abfaf58d271166182

SHA1
c073d8140fd6897813e0fda8e8651c28eeab0a70

SHA256
a080c26e58dd89b52b763aac96bcbb185668dfd5f8eecf258945c4b59e8d3e37

SHA512
df3559b7a6ee3a90566c0e53044f41a398796a2b9352fa1ce500760e8680eb60756771b3ba4bb89531e205f055a02dce06f9173d63e86f675d921efcddb386d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
33419c56dcbca9cf1ee181f086deef8b

SHA1
580d4d198c547758240ef2859ee0dbea7f3000d0

SHA256
31611c096dee492e6658f57ddf24f4858fa3e47eceb9888caeb515dc7a50c8b9

SHA512
58ec67fa458ac270822f3f1157c9cd9ef2a4738eb383b898534f82c94280ae438a08edbe1f9f1e3dd72fa998a7eee4ae6c592e01834875cf906400c0b4507bb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
13KB

MD5
d4f5550005a370480bea1cd4932b69d2

SHA1
c790fecbb801a5a068ec89e1cc9ec2c0b4b3f0d1

SHA256
129552956ada8bed7a3350d7ae3db988041c9bde1cac6c2a035fd8b662a9efc2

SHA512
c370846a62b5b2c3d64a1bfa38f381b2eed623215d83b7df03c91f24977700f2bafc5d05057c06507621b55c41f2d1d5b1d6f0a4eb4341a769e0754779eebd2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
66f8d4c4379b77ad84fee551779ddec6

SHA1
09997a689a876ddb3280e805fb281966eaa7f810

SHA256
8dc7cd307c6495a25245750f0020708917b05b11929bf01c9b0551ede4d6043f

SHA512
6635c362dab0827c502f0d48e58c56023d55269930fabaf22b01891029b334eeab591444a120ecda7707a5192107df6dbe37e21f99b23a695bd034697e73cdc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
88c4f01ab6ae8605d27765150ada3426

SHA1
66bd6c3a9ee0c991e0186009f486bfaf6a3bf55b

SHA256
0293263356b572e209f87a276e2c9f56d33efa78d4bd75e1412d9b824d9f9db6

SHA512
10dacc83c549ab81293962030dc8e4cb22327d72f538a1cdb364614e07efb4d049b8cd730641e05678e76f9abd103036894db71b54faa1e42bc0fb418e1d5e98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
93819ca2b0353ee764528524c8a66f0b

SHA1
94a16dd75dbf6fab37c4b6d3a6a20a08a62e6952

SHA256
c391ba7d5e3e42072b1dca3b9b1dbedf11e0acfc0695688e49d055fa65c0cd5a

SHA512
3c12bb24964c71fc6c30293b9e56a0de91ae043bac920895dc9cb8f59dfef70132686989e77b0a92fad3551b709a1c305e0aff196685ce81a9866ce305cf73b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58047f.TMP

Filesize
48B

MD5
67cd0ace1d4dac43e33872443073ea76

SHA1
f5130a04e0a1b720867489b4a2d55f0ce8bdbdce

SHA256
a193efc0e7cf2849137fdcb37d7ed5fb03d69f333da72edca82361b65dbfe87a

SHA512
7279942ed31fc2ea9f61b4d5d3c105a1f491d79a8b7af516c7caa4c61635d8b88e1f05afadf11fc58ca5ceb8746c56acf8c52663ce233ea3a0d53a34fc63a0f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
96cee74c4bfdea718f5927c6b1fb9f1e

SHA1
c9f12f8bad53e5f969a0840078e00009abaf77b2

SHA256
0afaae139948ca813e8f23c2759422cac94774d8edce729a6c718a0e69f57ce6

SHA512
6dc2cf5749ed5bb4f64bd289b8dfd134d19205691688594872e097be858ce5425900cb9c5aa3bd9006028a06c0176a20ba00888e06d1cabb91bd002c179be9f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
37bacbd6dd01b344d9591a4b739c9a9c

SHA1
60a76bf1a48538249d0992ecf1589203c3ee62d9

SHA256
362deed1a03b5466218f2a0db180ae2f54b04be1c5c7e9a1eded68af422cdb27

SHA512
a802be7b35b2b087aaaf7c1fcfa845fcd577f30f5ca9e6cec866cc23a9c31c85f999d43cb38b53bcd2e4a1ea31800f613636bf9d298d16f19c2fd97ef3f89786

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
5abfbeb14a9ccb495052937fc49dd9e3

SHA1
98a090bf4bd156204d4bda0ccae670867bfb128c

SHA256
944032ef9c10e7b5649f2636f461f737b473b37d749679833dc643f1f432d7cf

SHA512
9582e9c0beaff77ae8cb727316f96b66dec141d835617f87ffdd0d06fb778e9fe9b36e4d42cfeea1cc8f3158923e9232730eef42673b043cf1eded739514230c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
08c89e7d5e490e8191f49eabc4068b91

SHA1
37c2b7fb9e340464e52de252abdf0791601452ec

SHA256
06217278dff08e32238c59a4ebe1185648494ed3da12b57d3e460c590f3b5a34

SHA512
b1881032b54e18bd01da936b3c438b3a1850ed39110f1dca6e7f4ec5109c479889088de0ecf000034a3fe678b3557fb6fccd57f97a95c6d685107972aea9e1ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
7KB

MD5
09862b1619a0ba98759847d84e5e8446

SHA1
140fe1eeb0025194e2766d9c45cc47ecd24df0e0

SHA256
4ef390f5eb622d46f0131385033463136f5be661e989b6a5f30e80ac4f4ee696

SHA512
4627fabab39e09036f93d1b64019a562926c94c465bed21f93771305ecc841486cdff0e81e15e42dcc6b1f41a337b4fc15d08a040294f39c85bf8713489db01a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
3d4863e1d3e8d07255565feb447f137e

SHA1
704b1470aa9f6d28e7a856a12daf0155e9fbe051

SHA256
263768d983453cba2c15b00695e10f5d85bff9961f611d5aa70fd8825b8f8b3e

SHA512
25279b929fdf1f2273fd2f52a42abd588ef43d4f690f5d5d31d64cff2ad48f0e644a8528eefa89076f8633531719822c50d9631d788003e1eb4339957d735c36

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
5KB

MD5
6acfe4cf3d6e3c0f03b05f35122a1551

SHA1
993417a2409b482326a09f0a88c2a53c384d65da

SHA256
186000f169309525283f35c693c3cc932de6cebbc9630ffc592ce7dfd6b3436c

SHA512
bb6c282591d0a769367df5890d0432a6c2006676ee3a06d49b4224f76c1fa8cd04b25af7ec696f7e531e60b9c5b56e1cbb70a883e6f59f691ebbc4001a209e93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
6KB

MD5
d1592d77b5c7f28fa9cb11a6cbf06546

SHA1
29881dea0aeb432b16c339be1d80a50f794e4f17

SHA256
7193109f45dbdfb10027df4290320b94f55de91c3022d571939eae205e49d3f3

SHA512
5e42b22c6eecc5756422f50541dcfa460d95dafa1b1c088a10d082ac18b2e9ea487375d46dc63e272decddff10b0e3d2d67bd0d9fe4a4b60d06de31693fc5193

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d4e4.TMP

Filesize
874B

MD5
e0aef17217997aed06d5365eeac4817f

SHA1
e18d4a791a588ad6d5f90c91ec0f63726b374101

SHA256
08fe2ad7d63e59a25c37e3fbb3858aeae1a873709e1ac081f133a606fdd2d5b0

SHA512
4ebd0bd0518c40b9e3fcdba22583d2cbaa7dd7cf7c91aadc23b355f1927f49ca5681be9aec1d63ca960b2ae6b44f495c1c4e7784359ac8b0bd92a3d5898a0182

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cc62ea51fc8803ac870fd641aa047373

SHA1
37a8b074ba08f9927603d5e50d5ee4cd4ecc48ef

SHA256
fe4cc8f3c1c8904cb564390b3dd433cbdedd9d3ad171e9213f61c759cf108df6

SHA512
edde1979720c8d28d900bb28ad6cbdebd9c7497facc20b7a7e8bccbc857ab95a772af0051545a223b67e7c67f0cde2de7cb4627edc198953038205beaa4f2dad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c18e24d23fb6009e8dd65cfdcf391e2d

SHA1
3b0f669032bf174e183b4490067fec296986e54a

SHA256
ed46c309aae4e1b41ddf2b543f370aa6c0620b87599d1e737624ed0e289d2d12

SHA512
6a89c408eeb5bbab3d71455c9e0fc532d345e2807ae02f9fd503a3981f785e7ddf4ed1c24125de887144a50f1038dbe6aba7feb6972234766091bb0b23e0ddab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
02a93025e58963326c0cab81c09b77b3

SHA1
bef00d0d0c4622ff7aa7ed237b99e318246a9e0c

SHA256
f9e63d923bad4294e25b00e62021f41276d9ac1490aa2fbbaac5a5b77f9e39b0

SHA512
fc5082c78bfc51e510108291796872b60a29db4e520fa2e11dc571b76b1062f695281443b070bb6ccadca9d3b5245768bc3d06129019d00197f81e382075e7e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c1b9cf6695c306fd53f43c9be3fe9bfa

SHA1
1669822761744d3c96a3f849f8ab53e9db034921

SHA256
21f7f6051712873bd16874ffdbda6fd34e682c24748ac65df585f4a7d7da4ae0

SHA512
f10a110ca92959118646f0e0ab39b5b11c08418dd6430a7dfd502d4b0e295afafe78f618d0c3ca0ecfc51af5ebb7e6547d95d350b7957423e12848cc71a452b3

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000002

Filesize
19KB

MD5
99af5da82ee74e7d9502225446604614

SHA1
7deff05853fbf1528875f9c358b8a6a31d6dee5e

SHA256
031fe7ea42e0a823949190f13ab143f1d9d26fb0b22d863b582593a37cbcda9d

SHA512
7d2cec0882df88edbb4789fc14c7721f6dca5681c85919ee1f033d5cb2324f9c1305707bbc4c534e0019a2b163291edf4bd65c374e843d75174589e7148aab07

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000003

Filesize
24KB

MD5
24c1ac9e5814fdba1876bd70e65b55d1

SHA1
440f8a4de77e05a029ae06d4f500c72308285d6e

SHA256
7cf9b84f3812c9377c20ff7b0826eda7092f11f33dd4af560413a6773f3fca43

SHA512
bc848fd4ccce7a1705b2b14b2ba1a1503a6a306096ac8460480bc653a2d9d4744fe21a0a39db573d7363b3c1252c6db1b594f029c04beeee9ccb5714c80af7cf

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000004

Filesize
40KB

MD5
a470afc683c0884e0eecbf5dc4145f75

SHA1
fca0247e27d464bfef50a7bc751c06a41e65cbd4

SHA256
510940a8bea63e45e47699ea55eac22bf4af4e8cba3b6f20a4948d21d8934553

SHA512
d8ab0bd333c9f809ebb384d53d82c7451a03178cf443c15b903f110b7bd8631dea11cfc0b479028f11105b7de623ec48793d8925c3ce268244c644c71b5072b4

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00000d

Filesize
17KB

MD5
78009b0bcd5f695070babef7964ce279

SHA1
817fb69778754c2d5976909a48525ea46136992a

SHA256
a179f5a994b7974aec4a54c2af8d07d1d0d9d2cfc66c81246e1299a5a0b1ad19

SHA512
922be73fde8d54afead642c60b480f7c2d54fda6c840cb6976b02f10d12d67df749b5af21b7e441342c2007a17287b1ed55a9dc894638ff8fe21454be171b42d

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_00000f

Filesize
218KB

MD5
e93e966d21aba85448fbad862ebbcbe3

SHA1
0bd6beb5ba0bee448204e60d3c40450b1bfa2f0e

SHA256
9cf8953f31921ac3c2c115ba667b1f2c6c7fd9996dfc01a988b4f708435b4678

SHA512
0c33f82e4e442d02505388f2824a4bba9fd509ab259104eb98ca7f482c2e92b88a15939826b3cbf833cb9c43d76cdbd4dcbf6dcced03499aa26f6f37855d45ec

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000012

Filesize
205KB

MD5
c9c9e7a0321c20a8faea53cb744f62a5

SHA1
a4f7964d6df916c63bc019879e15dfd8a010c9e8

SHA256
9dc45a4308a94cc765a3fe2409e6998871eadf786e01bd0fdcbc5e354ced331d

SHA512
12bfb41ca0dffe67448d2ca50e44432d60f150b588e168efcebe37ce4f030da3161936d443735587b9833eaf506d6448bce92985c16456caa6b2b94b48b7896e

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000013

Filesize
66KB

MD5
100655c23b1e2cbdadf8919bf6f14f50

SHA1
1b535aa013148bcf8dbae70f31064ed03380f97b

SHA256
9de4c1063286a2bcfe2c2b232e45bd8947e70d941f4685a50fd9d99cc6b74fe9

SHA512
9904ae2ea00d092f4d2cad4969d26e08b1840373e6869b358f11686d109b09eebe25fbb6a45671a918e1be53130a4ca20cb5e217348a855811cc4fdc32808f67

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Cache\Cache_Data\f_000014

Filesize
22KB

MD5
9d53309ac2415ed6efe77b43a5a2b2b6

SHA1
31d26e32f551242c037116da7fe1f039bd1c4b41

SHA256
31e667f7d809056c4199b4204f46dbc6cd118a97530308229bbb9d450c42f89f

SHA512
25510c4cd3ac3388a1c91b5011e12a34c409f272d8f7fbec1a89cbff45f2553f7061c1f63d1a2c06f8773b885bcabd9c96501434b8905778132fffef80989476

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
768B

MD5
a56beb3c41cb53349ec3ee0fc9eda439

SHA1
3c8997c3a533e588f02fa1dcbf9ac7fb853cdc2b

SHA256
bb65d1fb3cb4cde36217ab3312d017b6d0ac2a66cdc486c7e15ba88e849ffc0f

SHA512
b768c90cc7813c697bfbb623f1cf87e394bcdc4f4baac22c9fd491eba000860a6f1f1fab2e4178646b538f132f9d53bb6489f83885a92b3bb94268b8f2762de0

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
1d71f69e9fbc17b569e16edad18035f0

SHA1
b7da8973db7f61bbbee8805a959d86d8904a65ac

SHA256
140ea157623ffde7d69fa7e9abec0ec8a99a793db3798b85db58b294496a14f3

SHA512
f7f0c93b059417c8e2e4deccf115e67eab1156882ed086fb690feb4ff1e91fc449597920bfadd360d4db4b61d43f7980e1f26d1282f89aa3d4ca9a7e4214b20d

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
ccffe5eb8585f8b23942d49a1b0407ef

SHA1
bee630cdb5d1d4be836047982eb48453ca398e44

SHA256
360665bc5ee86ec58b6e9c0e85a097ac4c3025d402688237c4a56997fb8d2567

SHA512
cd49c60aac7b7f6c1d05ef837f5bba0cc6069afeb13a1008365dc69c980df02b6cc34b0456798f949e8ca255fd997eb12d111abb56abd981a4948baeb6299370

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_0

Filesize
8KB

MD5
cf89d16bb9107c631daabf0c0ee58efb

SHA1
3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

SHA256
d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

SHA512
8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_1

Filesize
264KB

MD5
d0d388f3865d0523e451d6ba0be34cc4

SHA1
8571c6a52aacc2747c048e3419e5657b74612995

SHA256
902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

SHA512
376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_2

Filesize
8KB

MD5
0962291d6d367570bee5454721c17e11

SHA1
59d10a893ef321a706a9255176761366115bedcb

SHA256
ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

SHA512
f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_3

Filesize
8KB

MD5
41876349cb12d6db992f1309f22df3f0

SHA1
5cf26b3420fc0302cd0a71e8d029739b8765be27

SHA256
e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

SHA512
e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

Filesize
822B

MD5
616e152d13d16aecf4c1c667086f2365

SHA1
5163e1bca8fea01da03781c6efe9b3512371912a

SHA256
4c8f4ee159171e6cd701700e8cbd5bbdee92645beb9568056d0426b98408be09

SHA512
149c431bb199777f51488ff2ed70c1bf20542df0fe008985a3f21b78756efb463e9199d0f97db6f7855e10774515dcc3c16acc8981d3f34ff7fededb56c2d999

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json

Filesize
710B

MD5
1de0d7a3a576b771cc8b42b0fe4ec1ad

SHA1
f681f12ce38645b65641ef14f8226337a5eaea53

SHA256
342d27240f9942731d8c85313263fd59eae64eb77cab96294cee53051aba5c74

SHA512
248218f40e10e079a0bd80d33436092527707930b494327e87cee0c689a9539eb0c2a8d651e8bfab6e231a5df0f579b338190f6747be51a4eac65fc7e69a3322

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\LocalPrefs.json~RFe5b3f86.TMP

Filesize
529B

MD5
569513e9e2f7b2a36e07426926c64d33

SHA1
359eafe1926f190bdea18149287bf002e17d2d0a

SHA256
ff2628264a91dcbf752b657372fa691cc230473dd8e5bebde47252ffa908a228

SHA512
c1686dc5671c660bb62c89f6796fa0f264c9b58f13025a9618cff6b75116eaa01c2c455ea8d38e6077f9a26a9941c55b244c4d5aa09d441f4b03d41c2ba27a1b

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\8fa94dc0-ee45-4bfb-903c-7bea6160fe29.tmp

Filesize
1KB

MD5
bedd3818788cdb1beb65767dd2fca69f

SHA1
9669442784e4180bef83e9b561deb29a1aeeff94

SHA256
1f9a415cc437003f87654564e67bfbdde11cae02eac1c6da1bc84b68a375f082

SHA512
01b1d94232c8784afadeff0d6939cf3702c17fee18ecba1f698e20b69cbdc5486e61a06dbd74254d888c7fbd3c23da3dd2126817f774c86e0c7a3218858c5362

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State

Filesize
1KB

MD5
ad694db054ae12616de8b1172bf39cc6

SHA1
12cda6b96cb6c25a89b95caf5fd285fba8fbe0a6

SHA256
c6bc0463e217650b1851c359734f6cd045500a93d5a70da69ca4dc54f38808e4

SHA512
9083ae6036f5e90202531df68b3188b7fc3b18ce13283e2bc445003b232c0fbf08a3892c382f3dcaca76e737f4708b6ff4df420a952f107ec42e4b9d1e1b783a

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\Network Persistent State~RFe5b52fe.TMP

Filesize
59B

MD5
2800881c775077e1c4b6e06bf4676de4

SHA1
2873631068c8b3b9495638c865915be822442c8b

SHA256
226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974

SHA512
e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b

Download Submit
C:\Users\Admin\AppData\Local\Steam\htmlcache\Network\TransportSecurity~RFe5aac5e.TMP

Filesize
188B

MD5
ea95ff718486c751a2ca508fc89efaa3

SHA1
6ecfca617b8d9896be680d436e90b81101728509

SHA256
f2087176d85edd5e4deb17c4c9f855b8e9585df78ad641501d86c89d77fc4cea

SHA512
98360a223a2ced949732260a27e5c24100c4168b879d75bab2eec21ea1b90b9fbcee922ca2daca299ee4435f0e8500be1986d6749d37f7d8c437980293f9b58e

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk392.tmp\StdUtils.dll

Filesize
110KB

MD5
db11ab4828b429a987e7682e495c1810

SHA1
29c2c2069c4975c90789dc6d3677b4b650196561

SHA256
c602c44a4d4088dbf5a659f36ba1c3a9d81f8367577de0cb940c0b8afee5c376

SHA512
460d1ccfc0d7180eae4e6f1a326d175fec78a7d6014447a9a79b6df501fa05cd4bd90f8f7a85b7b6a4610e2fa7059e30ae6e17bc828d370e5750de9b40b9ae88

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk392.tmp\System.dll

Filesize
22KB

MD5
a36fbe922ffac9cd85a845d7a813f391

SHA1
f656a613a723cc1b449034d73551b4fcdf0dcf1a

SHA256
fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0

SHA512
1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk392.tmp\modern-wizard.bmp

Filesize
150KB

MD5
3614a4be6b610f1daf6c801574f161fe

SHA1
6edee98c0084a94caa1fe0124b4c19f42b4e7de6

SHA256
16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b

SHA512
06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk392.tmp\nsDialogs.dll

Filesize
20KB

MD5
4e5bc4458afa770636f2806ee0a1e999

SHA1
76dcc64af867526f776ab9225e7f4fe076487765

SHA256
91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0

SHA512
b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk392.tmp\nsExec.dll

Filesize
17KB

MD5
2095af18c696968208315d4328a2b7fe

SHA1
b1b0e70c03724b2941e92c5098cc1fc0f2b51568

SHA256
3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226

SHA512
60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsk392.tmp\nsProcess.dll

Filesize
15KB

MD5
08072dc900ca0626e8c079b2c5bcfcf3

SHA1
35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37

SHA256
bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8

SHA512
8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 847123.crdownload

Filesize
2.3MB

MD5
1b54b70beef8eb240db31718e8f7eb5d

SHA1
da5995070737ec655824c92622333c489eb6bce4

SHA256
7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb

SHA512
fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2572_1335514636\LICENSE

Filesize
473B

MD5
f6719687bed7403612eaed0b191eb4a9

SHA1
dd03919750e45507743bd089a659e8efcefa7af1

SHA256
afb514e4269594234b32c873ba2cd3cc8892e836861137b531a40a1232820c59

SHA512
dd14a7eae05d90f35a055a5098d09cd2233d784f6ac228b5927925241689bff828e573b7a90a5196bfdd7aaeecf00f5c94486ad9e3910cfb07475fcfbb7f0d56

Download Submit
C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2572_1335514636\manifest.json

Filesize
1001B

MD5
2ff237adbc218a4934a8b361bcd3428e

SHA1
efad279269d9372dcf9c65b8527792e2e9e6ca7d

SHA256
25a702dd5389cc7b077c6b4e06c1fad9bdea74a9c37453388986d093c277d827

SHA512
bafd91699019ab756adf13633b825d9d9bae374ca146e8c05abc70c931d491d421268a6e6549a8d284782898bc6eb99e3017fbe3a98e09cd3dfecad19f95e542

Download Submit
memory/852-958-0x0000000000850000-0x0000000000D02000-memory.dmp

Filesize
4.7MB

Download
memory/1528-1124-0x0000018754BF0000-0x0000018754C5F000-memory.dmp

Filesize
444KB

Download
memory/1528-1001-0x00007FFABF430000-0x00007FFABF431000-memory.dmp

Filesize
4KB

Download
memory/1528-1000-0x00007FFABED80000-0x00007FFABED81000-memory.dmp

Filesize
4KB

Download
memory/1844-1735-0x000001D658C60000-0x000001D658C61000-memory.dmp

Filesize
4KB

Download
memory/1844-1734-0x000001D658C60000-0x000001D658C61000-memory.dmp

Filesize
4KB

Download
memory/1844-1733-0x000001D658C60000-0x000001D658C61000-memory.dmp

Filesize
4KB

Download
memory/2060-1619-0x000001E3018C0000-0x000001E30192F000-memory.dmp

Filesize
444KB

Download
memory/2116-1269-0x000000006F200000-0x0000000070553000-memory.dmp

Filesize
19.3MB

Download
memory/2116-1657-0x000000006F200000-0x0000000070553000-memory.dmp

Filesize
19.3MB

Download
memory/2116-1117-0x000000006F200000-0x0000000070553000-memory.dmp

Filesize
19.3MB

Download
memory/2116-1636-0x000000006F200000-0x0000000070553000-memory.dmp

Filesize
19.3MB

Download
memory/2116-1678-0x000000006F200000-0x0000000070553000-memory.dmp

Filesize
19.3MB

Download
memory/2116-1721-0x000000006F200000-0x0000000070553000-memory.dmp

Filesize
19.3MB

Download
memory/2116-1577-0x000000006F200000-0x0000000070553000-memory.dmp

Filesize
19.3MB

Download
memory/2116-1137-0x000000006F200000-0x0000000070553000-memory.dmp

Filesize
19.3MB

Download
memory/2116-1362-0x000000006F200000-0x0000000070553000-memory.dmp

Filesize
19.3MB

Download
memory/2116-1358-0x000000006F200000-0x0000000070553000-memory.dmp

Filesize
19.3MB

Download
memory/2116-1328-0x000000006F200000-0x0000000070553000-memory.dmp

Filesize
19.3MB

Download
memory/2116-1314-0x000000006F200000-0x0000000070553000-memory.dmp

Filesize
19.3MB

Download
memory/2420-1312-0x0000015C9BA10000-0x0000015C9BA7F000-memory.dmp

Filesize
444KB

Download
memory/2792-1313-0x0000028FA92D0000-0x0000028FA933F000-memory.dmp

Filesize
444KB

Download
memory/3680-1262-0x000002066FF50000-0x000002066FF51000-memory.dmp

Filesize
4KB

Download
memory/3680-1263-0x000002066FF50000-0x000002066FF51000-memory.dmp

Filesize
4KB

Download
memory/3680-1264-0x000002066FF50000-0x000002066FF51000-memory.dmp

Filesize
4KB

Download
memory/3680-1265-0x000002066FF50000-0x000002066FF51000-memory.dmp

Filesize
4KB

Download
memory/3680-1266-0x000002066FF50000-0x000002066FF51000-memory.dmp

Filesize
4KB

Download
memory/3680-1267-0x000002066FF50000-0x000002066FF51000-memory.dmp

Filesize
4KB

Download
memory/3680-1268-0x000002066FF50000-0x000002066FF51000-memory.dmp

Filesize
4KB

Download
memory/3680-1260-0x000002066FF50000-0x000002066FF51000-memory.dmp

Filesize
4KB

Download
memory/3680-1261-0x000002066FF50000-0x000002066FF51000-memory.dmp

Filesize
4KB

Download
memory/3680-1259-0x000002066FF50000-0x000002066FF51000-memory.dmp

Filesize
4KB

Download
memory/5348-1125-0x00000212A10C0000-0x00000212A112F000-memory.dmp

Filesize
444KB

Download