Overview

overview

9

Static

static

3

DepotDownloader.exe

windows10-2004-x64

1

DepotDownloader.exe

windows11-21h2-x64

9

Resubmissions

29/07/2026, 18:29

260729-w4wahasscy

19/04/2026, 01:34

260419-by8nesbs2r9

Analysis

  • user interaction
    yes
  • max time kernel
    1049s
  • max time network
    1052s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    19/04/2026, 01:34

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    DepotDownloader.exe
  • Size 75.2MB
  • Sample260419-by8nesbs2r
  • SHA256 6281279efce8f1e20db9532a58e42382f81afb9e3827a8b965ffcb43fbe4531f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoverypersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Renames multiple (6142) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 2 IoCs
  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 9 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Access Token Manipulation: Create Process with Token 1 TTPs 6 IoCs
    defense_evasionprivilege_escalation
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 9 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 36 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 29 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 5 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\DepotDownloader.exe
    "C:\Users\Admin\AppData\Local\Temp\DepotDownloader.exe"
    1⤵
      PID:3052
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:652
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:2436
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3bafc728,0x7ffe3bafc734,0x7ffe3bafc740
          2⤵
            PID:1872
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,11456673191420114741,5000864519906760760,262144 --field-trial-handle=1908,i,6850918419321165983,3324702222761980734,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1900 /prefetch:2
            2⤵
              PID:5012
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,6545662199056617805,7688038506237995276,524288 --field-trial-handle=1908,i,6850918419321165983,3324702222761980734,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2252 /prefetch:11
              2⤵
              • System Time Discovery
              PID:1416
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2384,i,15286105641812128583,11564950355533621918,524288 --field-trial-handle=1908,i,6850918419321165983,3324702222761980734,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2376 /prefetch:13
              2⤵
                PID:244
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3232,i,6914055868712817819,17220577063801395473,2097152 --field-trial-handle=1908,i,6850918419321165983,3324702222761980734,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3248 /prefetch:1
                2⤵
                  PID:4448
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3256,i,13883569579233194265,11298522250617024057,2097152 --field-trial-handle=1908,i,6850918419321165983,3324702222761980734,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3504 /prefetch:1
                  2⤵
                    PID:3156
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4196,i,10812828754476419793,7612660746991973607,2097152 --field-trial-handle=1908,i,6850918419321165983,3324702222761980734,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4200 /prefetch:9
                    2⤵
                      PID:2528
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4504,i,10882098975199758430,561644806773321458,2097152 --field-trial-handle=1908,i,6850918419321165983,3324702222761980734,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4636 /prefetch:1
                      2⤵
                        PID:3788
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5400,i,16663727648819952232,17216643350461179169,524288 --field-trial-handle=1908,i,6850918419321165983,3324702222761980734,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5192 /prefetch:14
                        2⤵
                          PID:396
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5700,i,13577975699504755601,14462672961375677355,2097152 --field-trial-handle=1908,i,6850918419321165983,3324702222761980734,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5648 /prefetch:1
                          2⤵
                            PID:3080
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3704,i,8275571291806880054,2534568003574874708,2097152 --field-trial-handle=1908,i,6850918419321165983,3324702222761980734,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3664 /prefetch:1
                            2⤵
                              PID:3648
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,13894827608272795903,3375596313116396534,524288 --field-trial-handle=1908,i,6850918419321165983,3324702222761980734,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5892 /prefetch:14
                              2⤵
                              • NTFS ADS
                              PID:3736
                          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                            1⤵
                              PID:3508
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                              1⤵
                                PID:4976
                              • C:\Windows\System32\DataExchangeHost.exe
                                C:\Windows\System32\DataExchangeHost.exe -Embedding
                                1⤵
                                  PID:3636
                                • C:\Users\Admin\Desktop\DepotDownloader.exe
                                  "C:\Users\Admin\Desktop\DepotDownloader.exe"
                                  1⤵
                                    PID:684
                                  • C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe
                                    "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.WindowsTerminal_8wekyb3d8bbwe\wt.exe" -d "C:\Users\Admin\Desktop\."
                                    1⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:2748
                                    • C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe
                                      wt.exe -d "C:\Users\Admin\Desktop\."
                                      2⤵
                                      • Suspicious use of FindShellTrayWindow
                                      • Suspicious use of SetWindowsHookEx
                                      • Suspicious use of WriteProcessMemory
                                      PID:396
                                      • C:\Windows\system32\wsl.exe
                                        C:\Windows\system32\wsl.exe --list
                                        3⤵
                                          PID:2496
                                        • C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe
                                          "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa14 --server 0xa10
                                          3⤵
                                            PID:2448
                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                            powershell.exe
                                            3⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious use of WriteProcessMemory
                                            PID:2628
                                            • C:\Users\Admin\Desktop\DepotDownloader.exe
                                              "C:\Users\Admin\Desktop\DepotDownloader.exe"
                                              4⤵
                                                PID:884
                                              • C:\Users\Admin\Desktop\DepotDownloader.exe
                                                "C:\Users\Admin\Desktop\DepotDownloader.exe" -app 648800 -depot 648801 -manifest 4830832075480360897 -dir ./raft_download -anonymous
                                                4⤵
                                                • Suspicious use of AdjustPrivilegeToken
                                                PID:2012
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                          1⤵
                                          • Drops file in Windows directory
                                          • Enumerates system info in registry
                                          • Modifies data under HKEY_USERS
                                          • Suspicious behavior: EnumeratesProcesses
                                          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of FindShellTrayWindow
                                          • Suspicious use of SendNotifyMessage
                                          • Suspicious use of WriteProcessMemory
                                          PID:4156
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffe3bafc728,0x7ffe3bafc734,0x7ffe3bafc740
                                            2⤵
                                              PID:956
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1568,i,3415611632482440383,16790273341889055770,262144 --field-trial-handle=1896,i,3387145795971484321,15984294018061494472,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=1892 /prefetch:2
                                              2⤵
                                                PID:1276
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2216,i,9009158056245653828,3845658625215827652,524288 --field-trial-handle=1896,i,3387145795971484321,15984294018061494472,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=2172 /prefetch:11
                                                2⤵
                                                • Downloads MZ/PE file
                                                • System Time Discovery
                                                PID:4436
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2340,i,421780045727216192,7367605385638400725,524288 --field-trial-handle=1896,i,3387145795971484321,15984294018061494472,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=2476 /prefetch:13
                                                2⤵
                                                  PID:3136
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3196,i,4366450331417579422,6130508066658919696,2097152 --field-trial-handle=1896,i,3387145795971484321,15984294018061494472,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3396 /prefetch:1
                                                  2⤵
                                                    PID:4320
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3288,i,1299367015902202401,2128834986611983283,2097152 --field-trial-handle=1896,i,3387145795971484321,15984294018061494472,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3440 /prefetch:1
                                                    2⤵
                                                      PID:1432
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4452,i,7412392848774750121,6456392145588284121,2097152 --field-trial-handle=1896,i,3387145795971484321,15984294018061494472,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=4436 /prefetch:1
                                                      2⤵
                                                        PID:2408
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4636,i,4535965023415159798,222117234632868518,2097152 --field-trial-handle=1896,i,3387145795971484321,15984294018061494472,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=4624 /prefetch:1
                                                        2⤵
                                                          PID:2304
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4456,i,14182752105598849529,1308404112193623731,2097152 --field-trial-handle=1896,i,3387145795971484321,15984294018061494472,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=4792 /prefetch:1
                                                          2⤵
                                                            PID:1156
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5132,i,16091537907109395881,10350610755253135382,524288 --field-trial-handle=1896,i,3387145795971484321,15984294018061494472,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5140 /prefetch:14
                                                            2⤵
                                                              PID:3552
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,12306787277220726514,14232942482980917013,524288 --field-trial-handle=1896,i,3387145795971484321,15984294018061494472,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5580 /prefetch:14
                                                              2⤵
                                                              • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                              • NTFS ADS
                                                              PID:4112
                                                            • C:\Users\Admin\Downloads\st-setup-1.8.30.exe
                                                              "C:\Users\Admin\Downloads\st-setup-1.8.30.exe"
                                                              2⤵
                                                              • Executes dropped EXE
                                                              • Loads dropped DLL
                                                              • Suspicious use of WriteProcessMemory
                                                              PID:5020
                                                              • C:\Windows\SYSTEM32\icacls.exe
                                                                icacls "C:\Program Files\SteamTools" /grant:r "*S-1-5-32-545:(OI)(CI)F" /T
                                                                3⤵
                                                                • Modifies file permissions
                                                                PID:3548
                                                              • C:\Windows\SYSTEM32\icacls.exe
                                                                icacls "C:\Program Files\SteamTools\*.*" /grant:r "*S-1-5-32-545:(OI)(CI)F"
                                                                3⤵
                                                                • Modifies file permissions
                                                                PID:3212
                                                              • C:\Windows\explorer.exe
                                                                "C:\Windows\explorer.exe" "C:\Program Files\SteamTools\SteamTools.exe"
                                                                3⤵
                                                                  PID:4724
                                                            • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                              "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                              1⤵
                                                                PID:1892
                                                              • C:\Windows\system32\svchost.exe
                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                1⤵
                                                                  PID:2012
                                                                • C:\Windows\explorer.exe
                                                                  C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
                                                                  1⤵
                                                                  • Suspicious use of WriteProcessMemory
                                                                  PID:2496
                                                                  • C:\Program Files\SteamTools\SteamTools.exe
                                                                    "C:\Program Files\SteamTools\SteamTools.exe"
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    • Loads dropped DLL
                                                                    • NTFS ADS
                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                    • Suspicious use of SendNotifyMessage
                                                                    • Suspicious use of SetWindowsHookEx
                                                                    PID:4496
                                                                    • C:\program files (x86)\steam\steam.exe
                                                                      "C:\program files (x86)\steam\steam.exe" -noverifyfiles
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Checks SCSI registry key(s)
                                                                      • Checks processor information in registry
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:27216
                                                                      • C:\program files (x86)\steam\steamsysinfo.exe
                                                                        "C:\program files (x86)\steam\steamsysinfo.exe" -steamid 0 -buildid 1773426488 -logdir "C:\program files (x86)\steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\1205.tmp
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:1272
                                                                      • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=27216" "-buildid=1773426488" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\program files (x86)\steam\clientui" "-steampath=C:\program files (x86)\steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,ValveFFmpegAllowLowDelayHEVC"
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        • Drops file in Windows directory
                                                                        • Checks processor information in registry
                                                                        • Enumerates system info in registry
                                                                        • Modifies data under HKEY_USERS
                                                                        PID:27384
                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\program files (x86)\steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1773426488 --initial-client-data=0x28c,0x290,0x294,0x288,0x298,0x7ffe353daf00,0x7ffe353daf0c,0x7ffe353daf18
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:27424
                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1836,i,5714512769748614941,4783711870193767741,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1840 --mojo-platform-channel-handle=1832 /prefetch:2
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:27644
                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --field-trial-handle=2068,i,5714512769748614941,4783711870193767741,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2124 --mojo-platform-channel-handle=2120 /prefetch:11
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • System Time Discovery
                                                                          PID:5964
                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --field-trial-handle=2208,i,5714512769748614941,4783711870193767741,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2700 --mojo-platform-channel-handle=2692 /prefetch:13
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:4592
                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3872,i,5714512769748614941,4783711870193767741,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=3896 --mojo-platform-channel-handle=3892 /prefetch:1
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          • Drops file in Program Files directory
                                                                          PID:1356
                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4376,i,5714512769748614941,4783711870193767741,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4556 --mojo-platform-channel-handle=4292 /prefetch:1
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:23348
                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4632,i,5714512769748614941,4783711870193767741,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4700 --mojo-platform-channel-handle=4896 /prefetch:1
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:5644
                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4964,i,5714512769748614941,4783711870193767741,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5248 --mojo-platform-channel-handle=5216 /prefetch:1
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:6308
                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5080,i,5714512769748614941,4783711870193767741,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4764 --mojo-platform-channel-handle=4372 /prefetch:1
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:5800
                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5544,i,5714512769748614941,4783711870193767741,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5556 --mojo-platform-channel-handle=5552 /prefetch:1
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:5880
                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4852,i,5714512769748614941,4783711870193767741,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5076 --mojo-platform-channel-handle=5052 /prefetch:1
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:6184
                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --field-trial-handle=4880,i,5714512769748614941,4783711870193767741,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5376 --mojo-platform-channel-handle=4660 /prefetch:14
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:6120
                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --field-trial-handle=4300,i,5714512769748614941,4783711870193767741,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4752 --mojo-platform-channel-handle=5196 /prefetch:12
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:7632
                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5072,i,5714512769748614941,4783711870193767741,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4944 --mojo-platform-channel-handle=4928 /prefetch:1
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:8092
                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5300,i,5714512769748614941,4783711870193767741,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5468 --mojo-platform-channel-handle=5484 /prefetch:1
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:7952
                                                                        • C:\program files (x86)\steam\steamerrorreporter64.exe
                                                                          C:\program files (x86)\steam\steamerrorreporter64.exe -pid=27384
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:8264
                                                                      • C:\program files (x86)\steam\bin\gldriverquery64.exe
                                                                        .\bin\gldriverquery64.exe
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:5576
                                                                      • C:\program files (x86)\steam\bin\gldriverquery.exe
                                                                        .\bin\gldriverquery.exe
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:4060
                                                                      • C:\program files (x86)\steam\bin\vulkandriverquery64.exe
                                                                        .\bin\vulkandriverquery64.exe
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:1552
                                                                      • C:\program files (x86)\steam\bin\vulkandriverquery.exe
                                                                        .\bin\vulkandriverquery.exe
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:1632
                                                                    • C:\program files (x86)\steam\steam.exe
                                                                      "C:\program files (x86)\steam\steam.exe"
                                                                      3⤵
                                                                      • Executes dropped EXE
                                                                      • Drops file in Program Files directory
                                                                      • Checks SCSI registry key(s)
                                                                      • Checks processor information in registry
                                                                      • Modifies registry class
                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:8308
                                                                      • C:\program files (x86)\steam\steamsysinfo.exe
                                                                        "C:\program files (x86)\steam\steamsysinfo.exe" -steamid 0 -buildid 1773426488 -logdir "C:\program files (x86)\steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\983D.tmp
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:8504
                                                                      • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=8308" "-buildid=1773426488" "-steamid=0" "-logdir=C:\program files (x86)\steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\program files (x86)\steam\clientui" "-steampath=C:\program files (x86)\steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\program files (x86)\steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,ValveFFmpegAllowLowDelayHEVC"
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        • Checks processor information in registry
                                                                        PID:8952
                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\program files (x86)\steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1773426488 --initial-client-data=0x288,0x28c,0x290,0x284,0x294,0x7ffe353daf00,0x7ffe353daf0c,0x7ffe353daf18
                                                                          5⤵
                                                                          • Executes dropped EXE
                                                                          PID:8988
                                                                      • C:\program files (x86)\steam\bin\gldriverquery64.exe
                                                                        .\bin\gldriverquery64.exe
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:10112
                                                                      • C:\program files (x86)\steam\bin\gldriverquery.exe
                                                                        .\bin\gldriverquery.exe
                                                                        4⤵
                                                                        • Executes dropped EXE
                                                                        PID:10360
                                                                      • C:\program files (x86)\steam\bin\vulkandriverquery64.exe
                                                                        .\bin\vulkandriverquery64.exe
                                                                        4⤵
                                                                          PID:10028
                                                                        • C:\program files (x86)\steam\bin\vulkandriverquery.exe
                                                                          .\bin\vulkandriverquery.exe
                                                                          4⤵
                                                                            PID:9248
                                                                          • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                            "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=8308" "-buildid=1773426488" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=1" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\program files (x86)\steam\clientui" "-steampath=C:\program files (x86)\steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,ValveFFmpegAllowLowDelayHEVC"
                                                                            4⤵
                                                                            • Drops file in Program Files directory
                                                                            • Drops file in Windows directory
                                                                            • Checks processor information in registry
                                                                            • Enumerates system info in registry
                                                                            • Modifies data under HKEY_USERS
                                                                            PID:11504
                                                                            • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                              "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\program files (x86)\steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1773426488 --initial-client-data=0x298,0x29c,0x2a0,0x294,0x2a4,0x7ffe353daf00,0x7ffe353daf0c,0x7ffe353daf18
                                                                              5⤵
                                                                                PID:11528
                                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1816,i,8377571366804544041,6565350065752835957,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1824 --mojo-platform-channel-handle=1812 /prefetch:2
                                                                                5⤵
                                                                                  PID:11260
                                                                                • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                  "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --field-trial-handle=2036,i,8377571366804544041,6565350065752835957,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2104 --mojo-platform-channel-handle=2100 /prefetch:11
                                                                                  5⤵
                                                                                  • System Time Discovery
                                                                                  PID:11228
                                                                                • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                  "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --field-trial-handle=2228,i,8377571366804544041,6565350065752835957,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2676 --mojo-platform-channel-handle=2668 /prefetch:13
                                                                                  5⤵
                                                                                    PID:11272
                                                                                  • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                    "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3856,i,8377571366804544041,6565350065752835957,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=3872 --mojo-platform-channel-handle=3864 /prefetch:1
                                                                                    5⤵
                                                                                      PID:9384
                                                                                    • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                      "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --field-trial-handle=4412,i,8377571366804544041,6565350065752835957,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4548 --mojo-platform-channel-handle=4544 /prefetch:14
                                                                                      5⤵
                                                                                        PID:11720
                                                                                      • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4604,i,8377571366804544041,6565350065752835957,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4872 --mojo-platform-channel-handle=2480 /prefetch:1
                                                                                        5⤵
                                                                                          PID:10624
                                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=5016,i,8377571366804544041,6565350065752835957,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5044 --mojo-platform-channel-handle=5040 /prefetch:1
                                                                                          5⤵
                                                                                            PID:16576
                                                                                          • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                            "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5436,i,8377571366804544041,6565350065752835957,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5408 --mojo-platform-channel-handle=5396 /prefetch:1
                                                                                            5⤵
                                                                                              PID:17332
                                                                                            • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                              "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5056,i,8377571366804544041,6565350065752835957,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4960 --mojo-platform-channel-handle=4952 /prefetch:1
                                                                                              5⤵
                                                                                                PID:20512
                                                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5144,i,8377571366804544041,6565350065752835957,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4920 --mojo-platform-channel-handle=5032 /prefetch:1
                                                                                                5⤵
                                                                                                  PID:20524
                                                                                                • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                  "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --field-trial-handle=5556,i,8377571366804544041,6565350065752835957,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5576 --mojo-platform-channel-handle=5484 /prefetch:12
                                                                                                  5⤵
                                                                                                    PID:20680
                                                                                                  • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                    "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1128,i,8377571366804544041,6565350065752835957,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=932 --mojo-platform-channel-handle=1408 /prefetch:10
                                                                                                    5⤵
                                                                                                      PID:18508
                                                                                                    • C:\program files (x86)\steam\steamerrorreporter64.exe
                                                                                                      C:\program files (x86)\steam\steamerrorreporter64.exe -pid=11504
                                                                                                      5⤵
                                                                                                        PID:3932
                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://store.steampowered.com/
                                                                                                    3⤵
                                                                                                    • Drops file in Windows directory
                                                                                                    • Enumerates system info in registry
                                                                                                    • Modifies registry class
                                                                                                    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                    PID:27708
                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2e0,0x2f4,0x7ffe2d5ec188,0x7ffe2d5ec194,0x7ffe2d5ec1a0
                                                                                                      4⤵
                                                                                                        PID:27736
                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1952,i,9266268945087358387,11991917889569603531,262144 --field-trial-handle=2016,i,15515038483575263068,6479890358251782085,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:2
                                                                                                        4⤵
                                                                                                          PID:27972
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,11260469512547223843,14115519693268172598,524288 --field-trial-handle=2016,i,15515038483575263068,6479890358251782085,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:11
                                                                                                          4⤵
                                                                                                          • System Time Discovery
                                                                                                          PID:27976
                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,10985306374302490029,1244944353306689191,524288 --field-trial-handle=2016,i,15515038483575263068,6479890358251782085,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:13
                                                                                                          4⤵
                                                                                                            PID:28168
                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3540,i,18160453275155334691,17706874662188924694,2097152 --field-trial-handle=2016,i,15515038483575263068,6479890358251782085,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
                                                                                                            4⤵
                                                                                                              PID:12140
                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,16800361761814373653,10058505738919810494,2097152 --field-trial-handle=2016,i,15515038483575263068,6479890358251782085,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
                                                                                                              4⤵
                                                                                                                PID:12148
                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,6301904167448933858,7456814719736580154,2097152 --field-trial-handle=2016,i,15515038483575263068,6479890358251782085,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
                                                                                                                4⤵
                                                                                                                  PID:12596
                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,6537364547664072091,3965115194735645449,2097152 --field-trial-handle=2016,i,15515038483575263068,6479890358251782085,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
                                                                                                                  4⤵
                                                                                                                    PID:12604
                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4296,i,11933402719465452170,3725451654164939427,2097152 --field-trial-handle=2016,i,15515038483575263068,6479890358251782085,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
                                                                                                                    4⤵
                                                                                                                      PID:12612
                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4332,i,3308721497214199338,9348699585319670936,2097152 --field-trial-handle=2016,i,15515038483575263068,6479890358251782085,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:9
                                                                                                                      4⤵
                                                                                                                        PID:12624
                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,1419936130121185238,1414936494657556216,524288 --field-trial-handle=2016,i,15515038483575263068,6479890358251782085,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
                                                                                                                        4⤵
                                                                                                                          PID:12884
                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,15050939979466608622,2110608582790814686,524288 --field-trial-handle=2016,i,15515038483575263068,6479890358251782085,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:14
                                                                                                                          4⤵
                                                                                                                            PID:9484
                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,12399276578445108960,11246924795704320215,524288 --field-trial-handle=2016,i,15515038483575263068,6479890358251782085,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14
                                                                                                                            4⤵
                                                                                                                              PID:14224
                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,1524920015493190749,9469148604749842319,524288 --field-trial-handle=2016,i,15515038483575263068,6479890358251782085,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:14
                                                                                                                              4⤵
                                                                                                                                PID:14232
                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,8120706851505660192,2211204858405472747,524288 --field-trial-handle=2016,i,15515038483575263068,6479890358251782085,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
                                                                                                                                4⤵
                                                                                                                                  PID:14680
                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,8120706851505660192,2211204858405472747,524288 --field-trial-handle=2016,i,15515038483575263068,6479890358251782085,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
                                                                                                                                  4⤵
                                                                                                                                    PID:14696
                                                                                                                                • C:\program files (x86)\steam\steam.exe
                                                                                                                                  "C:\program files (x86)\steam\steam.exe"
                                                                                                                                  3⤵
                                                                                                                                    PID:16932
                                                                                                                                  • C:\program files (x86)\steam\steam.exe
                                                                                                                                    "C:\program files (x86)\steam\steam.exe"
                                                                                                                                    3⤵
                                                                                                                                    • Checks SCSI registry key(s)
                                                                                                                                    • Checks processor information in registry
                                                                                                                                    • Modifies registry class
                                                                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                                                                    PID:28308
                                                                                                                                    • C:\program files (x86)\steam\steamsysinfo.exe
                                                                                                                                      "C:\program files (x86)\steam\steamsysinfo.exe" -steamid 0 -buildid 1773426488 -logdir "C:\program files (x86)\steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\D8E7.tmp
                                                                                                                                      4⤵
                                                                                                                                        PID:12244
                                                                                                                                      • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=28308" "-buildid=1773426488" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\program files (x86)\steam\clientui" "-steampath=C:\program files (x86)\steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,ValveFFmpegAllowLowDelayHEVC"
                                                                                                                                        4⤵
                                                                                                                                        • Drops file in Windows directory
                                                                                                                                        • Checks processor information in registry
                                                                                                                                        • Enumerates system info in registry
                                                                                                                                        PID:12456
                                                                                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\program files (x86)\steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1773426488 --initial-client-data=0x28c,0x290,0x294,0x288,0x298,0x7ffe353daf00,0x7ffe353daf0c,0x7ffe353daf18
                                                                                                                                          5⤵
                                                                                                                                            PID:12496
                                                                                                                                          • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                            "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1724,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1844 --mojo-platform-channel-handle=1824 /prefetch:2
                                                                                                                                            5⤵
                                                                                                                                              PID:13096
                                                                                                                                            • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                              "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --field-trial-handle=2120,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2176 --mojo-platform-channel-handle=2172 /prefetch:11
                                                                                                                                              5⤵
                                                                                                                                              • System Time Discovery
                                                                                                                                              PID:13532
                                                                                                                                            • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                              "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --field-trial-handle=2272,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2288 --mojo-platform-channel-handle=2284 /prefetch:13
                                                                                                                                              5⤵
                                                                                                                                                PID:13544
                                                                                                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3892,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=3904 --mojo-platform-channel-handle=3900 /prefetch:1
                                                                                                                                                5⤵
                                                                                                                                                  PID:14036
                                                                                                                                                • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                  "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4732,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4752 --mojo-platform-channel-handle=4748 /prefetch:1
                                                                                                                                                  5⤵
                                                                                                                                                    PID:2144
                                                                                                                                                  • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                    "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --field-trial-handle=4928,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4980 --mojo-platform-channel-handle=4976 /prefetch:14
                                                                                                                                                    5⤵
                                                                                                                                                      PID:17476
                                                                                                                                                    • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                      "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4500,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4476 --mojo-platform-channel-handle=4372 /prefetch:1
                                                                                                                                                      5⤵
                                                                                                                                                        PID:17596
                                                                                                                                                      • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4692,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4748 --mojo-platform-channel-handle=4740 /prefetch:1
                                                                                                                                                        5⤵
                                                                                                                                                          PID:18556
                                                                                                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4676,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4708 --mojo-platform-channel-handle=5016 /prefetch:1
                                                                                                                                                          5⤵
                                                                                                                                                            PID:18672
                                                                                                                                                          • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                            "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5764,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4864 --mojo-platform-channel-handle=5720 /prefetch:1
                                                                                                                                                            5⤵
                                                                                                                                                              PID:18684
                                                                                                                                                            • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                              "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5380,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5108 --mojo-platform-channel-handle=4332 /prefetch:1
                                                                                                                                                              5⤵
                                                                                                                                                                PID:20448
                                                                                                                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4728,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4668 --mojo-platform-channel-handle=4724 /prefetch:1
                                                                                                                                                                5⤵
                                                                                                                                                                  PID:12992
                                                                                                                                                                • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                  "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5320,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4800 --mojo-platform-channel-handle=5728 /prefetch:1
                                                                                                                                                                  5⤵
                                                                                                                                                                    PID:5488
                                                                                                                                                                  • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                    "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --field-trial-handle=5172,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5712 --mojo-platform-channel-handle=5708 /prefetch:12
                                                                                                                                                                    5⤵
                                                                                                                                                                      PID:14816
                                                                                                                                                                    • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                      "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=5704,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5008 --mojo-platform-channel-handle=5400 /prefetch:1
                                                                                                                                                                      5⤵
                                                                                                                                                                        PID:10528
                                                                                                                                                                      • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5692,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4976 --mojo-platform-channel-handle=4644 /prefetch:1
                                                                                                                                                                        5⤵
                                                                                                                                                                          PID:10492
                                                                                                                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=5660,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5792 --mojo-platform-channel-handle=5788 /prefetch:1
                                                                                                                                                                          5⤵
                                                                                                                                                                            PID:5648
                                                                                                                                                                          • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                            "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5396,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4764 --mojo-platform-channel-handle=4652 /prefetch:1
                                                                                                                                                                            5⤵
                                                                                                                                                                              PID:5712
                                                                                                                                                                            • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                              "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4544,i,11219865046480702263,8849662814800043864,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4568 --mojo-platform-channel-handle=5680 /prefetch:10
                                                                                                                                                                              5⤵
                                                                                                                                                                                PID:6444
                                                                                                                                                                            • C:\program files (x86)\steam\bin\gldriverquery64.exe
                                                                                                                                                                              .\bin\gldriverquery64.exe
                                                                                                                                                                              4⤵
                                                                                                                                                                                PID:14208
                                                                                                                                                                              • C:\program files (x86)\steam\bin\gldriverquery.exe
                                                                                                                                                                                .\bin\gldriverquery.exe
                                                                                                                                                                                4⤵
                                                                                                                                                                                  PID:15452
                                                                                                                                                                                • C:\program files (x86)\steam\bin\vulkandriverquery64.exe
                                                                                                                                                                                  .\bin\vulkandriverquery64.exe
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:15492
                                                                                                                                                                                  • C:\program files (x86)\steam\bin\vulkandriverquery.exe
                                                                                                                                                                                    .\bin\vulkandriverquery.exe
                                                                                                                                                                                    4⤵
                                                                                                                                                                                      PID:15552
                                                                                                                                                                              • C:\Program Files\SteamTools\SteamTools.exe
                                                                                                                                                                                "C:\Program Files\SteamTools\SteamTools.exe"
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Executes dropped EXE
                                                                                                                                                                                • Loads dropped DLL
                                                                                                                                                                                PID:564
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                1⤵
                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                • Checks SCSI registry key(s)
                                                                                                                                                                                • Enumerates system info in registry
                                                                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                • Suspicious use of SendNotifyMessage
                                                                                                                                                                                • Suspicious use of WriteProcessMemory
                                                                                                                                                                                PID:3644
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x10c,0x110,0x114,0xe8,0x118,0x7ffe3bafc728,0x7ffe3bafc734,0x7ffe3bafc740
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:1264
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1588,i,15139254398258909287,15083923470326478244,262144 --field-trial-handle=1880,i,17901061261143371690,12551156123754702145,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=1876 /prefetch:2
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:3008
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2216,i,3803917661689840113,8931587425470857777,524288 --field-trial-handle=1880,i,17901061261143371690,12551156123754702145,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=2220 /prefetch:11
                                                                                                                                                                                      2⤵
                                                                                                                                                                                      • Downloads MZ/PE file
                                                                                                                                                                                      • System Time Discovery
                                                                                                                                                                                      PID:4796
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,12280898224942393598,5396556192622363930,524288 --field-trial-handle=1880,i,17901061261143371690,12551156123754702145,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=2456 /prefetch:13
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:4688
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3240,i,14641466673529095634,15276070634931943168,2097152 --field-trial-handle=1880,i,17901061261143371690,12551156123754702145,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3268 /prefetch:1
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:1036
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,15058567644241497434,10777590199300380240,2097152 --field-trial-handle=1880,i,17901061261143371690,12551156123754702145,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3452 /prefetch:1
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:4396
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4408,i,7329821329713082397,12937996361321300783,2097152 --field-trial-handle=1880,i,17901061261143371690,12551156123754702145,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=4500 /prefetch:1
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:3936
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,10429958867504826169,7759963254430589245,2097152 --field-trial-handle=1880,i,17901061261143371690,12551156123754702145,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=4680 /prefetch:1
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1008
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3504,i,14710256542333927518,10189570409059575938,2097152 --field-trial-handle=1880,i,17901061261143371690,12551156123754702145,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3700 /prefetch:1
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:4776
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3080,i,13061225197187048429,12768366399561430494,2097152 --field-trial-handle=1880,i,17901061261143371690,12551156123754702145,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3572 /prefetch:1
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:1524
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4720,i,8782516970873537508,1877986603224824358,2097152 --field-trial-handle=1880,i,17901061261143371690,12551156123754702145,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=4324 /prefetch:1
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:3184
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=4864,i,2771953069098601170,10118255340355423508,2097152 --field-trial-handle=1880,i,17901061261143371690,12551156123754702145,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=4768 /prefetch:1
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:4036
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5848,i,10746609447584127632,8095792752386161305,524288 --field-trial-handle=1880,i,17901061261143371690,12551156123754702145,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5852 /prefetch:14
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:1640
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5860,i,6494012270871888658,2480517647615662831,2097152 --field-trial-handle=1880,i,17901061261143371690,12551156123754702145,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5868 /prefetch:1
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:244
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3640,i,1633801143374072797,14100662600900483974,2097152 --field-trial-handle=1880,i,17901061261143371690,12551156123754702145,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=4680 /prefetch:1
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:4736
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4748,i,11458986784725723844,11164072980835835120,2097152 --field-trial-handle=1880,i,17901061261143371690,12551156123754702145,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=4728 /prefetch:1
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:2144
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6188,i,4213997916000841775,10545624442868005941,524288 --field-trial-handle=1880,i,17901061261143371690,12551156123754702145,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=6176 /prefetch:14
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                                                                                                                                                                • NTFS ADS
                                                                                                                                                                                                                PID:2556
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=3672,i,15378315153977996591,1355386763478629753,524288 --field-trial-handle=1880,i,17901061261143371690,12551156123754702145,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=6192 /prefetch:14
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:4572
                                                                                                                                                                                                                • C:\Users\Admin\Downloads\SteamSetup.exe
                                                                                                                                                                                                                  "C:\Users\Admin\Downloads\SteamSetup.exe"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                  • Adds Run key to start application
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                  PID:1788
                                                                                                                                                                                                                  • C:\Program Files (x86)\Steam\bin\steamservice.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    PID:2024
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:3832
                                                                                                                                                                                                                • C:\Program Files (x86)\Steam\Steam.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Steam\steam.exe" -silent
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                  PID:3960
                                                                                                                                                                                                                  • C:\Program Files (x86)\Steam\Steam.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Steam\Steam.exe" -silent
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                                                                    • Drops file in Program Files directory
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                    PID:28268
                                                                                                                                                                                                                    • C:\Program Files (x86)\Steam\Steam.exe
                                                                                                                                                                                                                      "C:\Program Files (x86)\Steam\Steam.exe" -silent
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                      • Executes dropped EXE
                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                                                                                                      • Checks SCSI registry key(s)
                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                      • Modifies registry class
                                                                                                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                      • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                      • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                      PID:8864
                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\steamsysinfo.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Steam\steamsysinfo.exe" -steamid 0 -buildid 1773426488 -logdir "C:\Program Files (x86)\Steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\F73F.tmp
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                        PID:8828
                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                                                                        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=8864" "-buildid=1773426488" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,ValveFFmpegAllowLowDelayHEVC"
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • Loads dropped DLL
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                        • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                        PID:8180
                                                                                                                                                                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1773426488 --initial-client-data=0x288,0x28c,0x290,0x284,0x294,0x7ffe353daf00,0x7ffe353daf0c,0x7ffe353daf18
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                          PID:10456
                                                                                                                                                                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,8727462871365034832,6083395411963845180,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1836 --mojo-platform-channel-handle=1744 /prefetch:2
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • Loads dropped DLL
                                                                                                                                                                                                                          PID:9884
                                                                                                                                                                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --field-trial-handle=2120,i,8727462871365034832,6083395411963845180,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2208 --mojo-platform-channel-handle=2204 /prefetch:11
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          • System Time Discovery
                                                                                                                                                                                                                          PID:9548
                                                                                                                                                                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --field-trial-handle=2284,i,8727462871365034832,6083395411963845180,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2296 --mojo-platform-channel-handle=2292 /prefetch:13
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:10068
                                                                                                                                                                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3988,i,8727462871365034832,6083395411963845180,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4008 --mojo-platform-channel-handle=4004 /prefetch:1
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:14828
                                                                                                                                                                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --field-trial-handle=4648,i,8727462871365034832,6083395411963845180,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4668 --mojo-platform-channel-handle=4664 /prefetch:14
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:15704
                                                                                                                                                                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4988,i,8727462871365034832,6083395411963845180,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4760 --mojo-platform-channel-handle=4764 /prefetch:1
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:20992
                                                                                                                                                                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4808,i,8727462871365034832,6083395411963845180,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5076 --mojo-platform-channel-handle=4660 /prefetch:1
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:21628
                                                                                                                                                                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4556,i,8727462871365034832,6083395411963845180,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5624 --mojo-platform-channel-handle=5644 /prefetch:1
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:22808
                                                                                                                                                                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4696,i,8727462871365034832,6083395411963845180,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4812 --mojo-platform-channel-handle=4740 /prefetch:1
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:22868
                                                                                                                                                                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5588,i,8727462871365034832,6083395411963845180,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5552 --mojo-platform-channel-handle=5196 /prefetch:1
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:5192
                                                                                                                                                                                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1773426488 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4832,i,8727462871365034832,6083395411963845180,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5192 --mojo-platform-channel-handle=5628 /prefetch:1
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:5200
                                                                                                                                                                                                                        • C:\Program Files (x86)\Steam\steamerrorreporter64.exe
                                                                                                                                                                                                                          C:\Program Files (x86)\Steam\steamerrorreporter64.exe -pid=8180
                                                                                                                                                                                                                          5⤵
                                                                                                                                                                                                                          • Executes dropped EXE
                                                                                                                                                                                                                          PID:23788
                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
                                                                                                                                                                                                                        .\bin\gldriverquery64.exe
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:14180
                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\bin\gldriverquery.exe
                                                                                                                                                                                                                        .\bin\gldriverquery.exe
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:1660
                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
                                                                                                                                                                                                                        .\bin\vulkandriverquery64.exe
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        PID:15356
                                                                                                                                                                                                                      • C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
                                                                                                                                                                                                                        .\bin\vulkandriverquery.exe
                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                        • Executes dropped EXE
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:15440
                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Steam\steamservice.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:1668
                                                                                                                                                                                                                • C:\Program Files (x86)\Steam\steam.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Steam\steam.exe"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  PID:28420
                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Steam\steamservice.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                  • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                  PID:11588
                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe" /Update
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:12928
                                                                                                                                                                                                                • C:\Program Files (x86)\Common Files\Steam\steamservice.exe
                                                                                                                                                                                                                  "C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                                                                  • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                  • Checks processor information in registry
                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                  • Modifies registry class
                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                  PID:12992
                                                                                                                                                                                                                • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                                                                                  C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E8
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:14028
                                                                                                                                                                                                                  • C:\Program Files (x86)\Steam\Steam.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Steam\Steam.exe"
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    PID:15504
                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Steam\steamservice.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    PID:27528
                                                                                                                                                                                                                  • C:\Program Files (x86)\Common Files\Steam\steamservice.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                                                                    • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                                    • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                    • Checks processor information in registry
                                                                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                                                                    • Modifies registry class
                                                                                                                                                                                                                    PID:9112
                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:28040
                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                                                                                                                                                      PID:20048
                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3bafc728,0x7ffe3bafc734,0x7ffe3bafc740
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:20072
                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1876,i,11642304211433742458,12474853056110009756,262144 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=1892 /prefetch:2
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:20404
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1892,i,12327542332530338387,12194988940505447018,524288 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=2064 /prefetch:11
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                            • System Time Discovery
                                                                                                                                                                                                                            PID:20464
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2352,i,1028533524500580179,7026506614895308268,524288 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=2400 /prefetch:13
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:21756
                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3248,i,11116475131444691142,3073334399040222687,2097152 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3252 /prefetch:1
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:21908
                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3536,i,8380561907914278421,5269823814067543321,2097152 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3548 /prefetch:1
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:21916
                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4568,i,17459557132340726934,17788903014588307422,2097152 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=4436 /prefetch:1
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:22660
                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5224,i,12472528553029760541,6854539730209516503,524288 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5236 /prefetch:14
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:22752
                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5552,i,14477193191651648993,16904462974556928553,524288 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5480 /prefetch:14
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:24180
                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,7553519838084665201,6504522751980751741,524288 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5652 /prefetch:14
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:24188
                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5516,i,10039147353373544016,8980117834112395771,524288 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5676 /prefetch:14
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:24196
                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5224,i,15130906989524478814,7201591563097780431,2097152 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5680 /prefetch:1
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:24764
                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=4688,i,7818969828708099616,10671708625216187652,2097152 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5632 /prefetch:1
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:24856
                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3648,i,1702735503751222067,6449768884056608722,2097152 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=4016 /prefetch:1
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:24992
                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3544,i,6581093151590536479,17158376508330197586,2097152 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5468 /prefetch:1
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:25184
                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4660,i,11141197118651205832,15630636864085655108,2097152 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5824 /prefetch:1
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:25332
                                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3416,i,9694124045932292262,7088870163527724976,2097152 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=3532 /prefetch:1
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:26164
                                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=4672,i,1972487868214555148,16540475884867494584,2097152 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5856 /prefetch:1
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                          PID:26200
                                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5992,i,15115567921956213231,13954312257837192302,2097152 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=6020 /prefetch:1
                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                            PID:26336
                                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=5804,i,2855151944978426492,15063851132491522580,2097152 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5476 /prefetch:1
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:26480
                                                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6172,i,12405857242749951605,13710364086145397149,2097152 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=6188 /prefetch:1
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:26540
                                                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=6336,i,10573844040131738230,7172571769258272070,2097152 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=6344 /prefetch:1
                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                  PID:26548
                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6580,i,2193723442692918633,4443248809200900874,524288 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=6628 /prefetch:14
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                  • NTFS ADS
                                                                                                                                                                                                                                                                  PID:26676
                                                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6688,i,12415101546759303788,9004005367594052029,2097152 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=6660 /prefetch:1
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:26688
                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=5980,i,4593077886173637769,12331390457498278925,2097152 --field-trial-handle=1896,i,17630927446987558333,7543399900624488890,262144 --variations-seed-version=20260418-030034.010000-production --mojo-platform-channel-handle=5500 /prefetch:1
                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                      PID:26964
                                                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:20488
                                                                                                                                                                                                                                                                    • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:22968
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Common Files\Steam\steamservice.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                        • Access Token Manipulation: Create Process with Token
                                                                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                                        • Checks processor information in registry
                                                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                                        PID:12944
                                                                                                                                                                                                                                                                      • C:\Windows\system32\sihost.exe
                                                                                                                                                                                                                                                                        sihost.exe
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:21392
                                                                                                                                                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                                                                                                                                                            explorer.exe /LOADSAVEDWINDOWS
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                                                                                                                                                            • Enumerates connected drives
                                                                                                                                                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                            PID:21580
                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                          PID:22296
                                                                                                                                                                                                                                                                        • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                                                                                                                                                                                                          "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                          PID:22316

                                                                                                                                                                                                                                                                        Network

                                                                                                                                                                                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                              Reconnaissance

                                                                                                                                                                                                                                                                              Resource Development

                                                                                                                                                                                                                                                                              Initial Access

                                                                                                                                                                                                                                                                              Execution

                                                                                                                                                                                                                                                                              Persistence

                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                              Active Setup

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1547.014

                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                              Privilege Escalation

                                                                                                                                                                                                                                                                              Access Token Manipulation

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1134

                                                                                                                                                                                                                                                                              Create Process with Token

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1134.002

                                                                                                                                                                                                                                                                              Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                              T1547

                                                                                                                                                                                                                                                                              Active Setup

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1547.014

                                                                                                                                                                                                                                                                              Registry Run Keys / Startup Folder

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1547.001

                                                                                                                                                                                                                                                                              Defense Evasion

                                                                                                                                                                                                                                                                              Access Token Manipulation

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1134

                                                                                                                                                                                                                                                                              Create Process with Token

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1134.002

                                                                                                                                                                                                                                                                              File and Directory Permissions Modification

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1222

                                                                                                                                                                                                                                                                              Modify Registry

                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                              T1112

                                                                                                                                                                                                                                                                              Subvert Trust Controls

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1553

                                                                                                                                                                                                                                                                              SIP and Trust Provider Hijacking

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1553.003

                                                                                                                                                                                                                                                                              Credential Access

                                                                                                                                                                                                                                                                              Discovery

                                                                                                                                                                                                                                                                              Browser Information Discovery

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1217

                                                                                                                                                                                                                                                                              Peripheral Device Discovery

                                                                                                                                                                                                                                                                              2
                                                                                                                                                                                                                                                                              T1120

                                                                                                                                                                                                                                                                              Query Registry

                                                                                                                                                                                                                                                                              6
                                                                                                                                                                                                                                                                              T1012

                                                                                                                                                                                                                                                                              System Information Discovery

                                                                                                                                                                                                                                                                              5
                                                                                                                                                                                                                                                                              T1082

                                                                                                                                                                                                                                                                              System Location Discovery

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1614

                                                                                                                                                                                                                                                                              System Language Discovery

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1614.001

                                                                                                                                                                                                                                                                              System Time Discovery

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1124

                                                                                                                                                                                                                                                                              Lateral Movement

                                                                                                                                                                                                                                                                              Collection

                                                                                                                                                                                                                                                                              Command and Control

                                                                                                                                                                                                                                                                              Web Service

                                                                                                                                                                                                                                                                              1
                                                                                                                                                                                                                                                                              T1102

                                                                                                                                                                                                                                                                              Exfiltration

                                                                                                                                                                                                                                                                              Impact

                                                                                                                                                                                                                                                                              Replay Monitor

                                                                                                                                                                                                                                                                              Loading Replay Monitor...

                                                                                                                                                                                                                                                                              Downloads

                                                                                                                                                                                                                                                                              SteamService.dll.new
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Common Files\Steam\SteamService.dll.new
                                                                                                                                                                                                                                                                              • Size 3.5MB
                                                                                                                                                                                                                                                                              • SHA256 7b6730263a0ee9fef1e1bd9a0a05a7f952f843af0412151e5f2cda835819fcca
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              SteamServiceTmp.exe
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe
                                                                                                                                                                                                                                                                              • Size 2.8MB
                                                                                                                                                                                                                                                                              • SHA256 eeed0d75b1e5f4bd1370d1a046a59830809f942ea923c3c6661636bfbddb0c19
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              cpuidsdk.dll.new
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Common Files\Steam\cpuidsdk.dll.new
                                                                                                                                                                                                                                                                              • Size 3.2MB
                                                                                                                                                                                                                                                                              • SHA256 f4bb9d0c583292ed099ee80e8ea3a5698c29d348e92b165d9577100029b9c940
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              crashhandler.dll
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Common Files\Steam\crashhandler.dll
                                                                                                                                                                                                                                                                              • Size 382KB
                                                                                                                                                                                                                                                                              • SHA256 bad79c49530aa12093919a58e5d9bf9847d33b406d97d14d896e9108125a722a
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              drivers.exe.new
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Common Files\Steam\drivers.exe.new
                                                                                                                                                                                                                                                                              • Size 7.2MB
                                                                                                                                                                                                                                                                              • SHA256 9daf97b4123452c29e1b9b1cb9b9e56e68441e4e2cb979b926c2c120e64ed404
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              secure_desktop_capture.exe
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Common Files\Steam\secure_desktop_capture.exe
                                                                                                                                                                                                                                                                              • Size 3.7MB
                                                                                                                                                                                                                                                                              • SHA256 6f156764844137da0ac76e1195abf68cc119fbee28e2ed48c54ae457ded92c04
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              service_default_Public_versions.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Common Files\Steam\service_default_Public_versions.vdf
                                                                                                                                                                                                                                                                              • Size 808B
                                                                                                                                                                                                                                                                              • SHA256 8f34aed61c3025a06ec920eed6b27744c5265b228797264ce3efd689002c9767
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              service_minimum_versions.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Common Files\Steam\service_minimum_versions.vdf
                                                                                                                                                                                                                                                                              • Size 727B
                                                                                                                                                                                                                                                                              • SHA256 a75ecb06d45017d2289ec27dac9f418c6ef82a9352e012670a0c67161c25c52c
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              steamerrorreporter.exe
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Common Files\Steam\steamerrorreporter.exe
                                                                                                                                                                                                                                                                              • Size 672KB
                                                                                                                                                                                                                                                                              • SHA256 49570d9d750228a9ee7362955166851540daa6029dc6dfaaeee4db81fdeba3b4
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              steamxboxutil64.exe
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Common Files\Steam\steamxboxutil64.exe
                                                                                                                                                                                                                                                                              • Size 753KB
                                                                                                                                                                                                                                                                              • SHA256 c05c5a24cd31875e01f18ca5227f717b0853b7bcd8baf18055ff3bba2ec5d598
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Steam.exe
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\Steam.exe
                                                                                                                                                                                                                                                                              • Size 4.2MB
                                                                                                                                                                                                                                                                              • SHA256 12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              bd2b709a08caf7286f73c51d3b3937667f7aa053.jpg
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\appcache\librarycache\1161040\bd2b709a08caf7286f73c51d3b3937667f7aa053.jpg
                                                                                                                                                                                                                                                                              • Size 638B
                                                                                                                                                                                                                                                                              • SHA256 7bd8b75aec0a4d4a377f3ca3a023fd8b7c5fc7dc6a2a66d17f8cdfe5b731ab0c
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              28e69f0757c1da202c47f40bdab7974820c7b1a5.jpg
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\appcache\librarycache\1628350\28e69f0757c1da202c47f40bdab7974820c7b1a5.jpg
                                                                                                                                                                                                                                                                              • Size 737B
                                                                                                                                                                                                                                                                              • SHA256 dc265cedb299f7d0ebf039c2e09bd18e4b581b75da92cb4848f6e2b206c01c4f
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              crash_reporter.cfg
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\bin\cef\cef.win64\crash_reporter.cfg
                                                                                                                                                                                                                                                                              • Size 378B
                                                                                                                                                                                                                                                                              • SHA256 4075a3a370eafa8a1522d638d707eccd209501715a677a8a0d35dc0a89366b24
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              debug.log
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\bin\cef\cef.win64\debug.log
                                                                                                                                                                                                                                                                              • Size 5KB
                                                                                                                                                                                                                                                                              • SHA256 4ad7bd3aa6542b327c3b61b5f3c3901d5fc790eee587fbe3181efda7bdf2d89b
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              config.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\config\config.vdf
                                                                                                                                                                                                                                                                              • Size 9KB
                                                                                                                                                                                                                                                                              • SHA256 27392c3a4a346c4facc5a2a155c7c76c1a7f4b49c99fdb2b490fc9d410311ebf
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              config.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\config\config.vdf
                                                                                                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                                                                                                              • SHA256 90b9bdc4a66b993b029fd7085ce6d2aee2fba32912fac463e63810aabc17a80b
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              config.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\config\config.vdf
                                                                                                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                                                                                                              • SHA256 20f5abd3ade2d6032b7771d3978e2aa531dd01ea88b23dfcfd01b6495de05d15
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              config.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\config\config.vdf
                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                              • SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              config.vdf~RFe5f1304.TMP
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\config\config.vdf~RFe5f1304.TMP
                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                              • SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\dumps\settings.dat
                                                                                                                                                                                                                                                                              • Size 56B
                                                                                                                                                                                                                                                                              • SHA256 26569d0a514c7632b018a4f115e292d7ce23b0dca8752e51203079e1f2104391
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              cef_log.txt
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\logs\cef_log.txt
                                                                                                                                                                                                                                                                              • Size 53KB
                                                                                                                                                                                                                                                                              • SHA256 2f2e42efbbc2a2f8f49b0966601feae79eecb79c4c43cb96ae5d969e41904615
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              btnOvrOffBottom.tga_
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\graphics\btnOvrOffBottom.tga_
                                                                                                                                                                                                                                                                              • Size 444B
                                                                                                                                                                                                                                                                              • SHA256 ecd13153d9d438809a38de30f3abbb0f6f92837a7e3cacb442a9a9309bcd78d9
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              [email protected]_
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
                                                                                                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                                                                                                              • SHA256 5afc5816946e0d7b6d57a99a60be71d9e88670d9a63c18e249c9266d8e95cd2f
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              cloud_localfiles.tga_
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\graphics\cloud_localfiles.tga_
                                                                                                                                                                                                                                                                              • Size 14KB
                                                                                                                                                                                                                                                                              • SHA256 c7a1b0021d1f943e497c592d83050ac85a3b93aff732f9b94cd26d9c41b37ca3
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              [email protected]_
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
                                                                                                                                                                                                                                                                              • Size 15KB
                                                                                                                                                                                                                                                                              • SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              [email protected]_
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
                                                                                                                                                                                                                                                                              • Size 92KB
                                                                                                                                                                                                                                                                              • SHA256 e0ce36b93ae67846424364085ad79ee24fe5c036e5f6a78a4acbe1583f22daab
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              icon_button_news_mousedown.tga_
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_
                                                                                                                                                                                                                                                                              • Size 20KB
                                                                                                                                                                                                                                                                              • SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              tabStdBottom.tga_
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\graphics\tabStdBottom.tga_
                                                                                                                                                                                                                                                                              • Size 48B
                                                                                                                                                                                                                                                                              • SHA256 5caa5fa3e79dcd8ec5ec20256ed7c77efaae77e0ae8d89e4a974c484cb177d84
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              steam_cloudsync.ico_
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\public\steam_cloudsync.ico_
                                                                                                                                                                                                                                                                              • Size 47KB
                                                                                                                                                                                                                                                                              • SHA256 5aaca90948de8f7d11264ed608a2f96acba061e6463d337d658b00ed1c552449
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              steam_cloudsync_posix.tga_
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\public\steam_cloudsync_posix.tga_
                                                                                                                                                                                                                                                                              • Size 64KB
                                                                                                                                                                                                                                                                              • SHA256 fd2abb8945c06a6b9c5444baf6ea523b52bf7a03a58b34ebe0a6a110630ed5f8
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              steam_tray.tga_
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\public\steam_tray.tga_
                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                              • SHA256 f747d5fd27e74412be05bb376c0ff12fcebb7f39c158eaa89ab6a0a9d92ef3b6
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              filter_clean_bulgarian.txt.gz_
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_
                                                                                                                                                                                                                                                                              • Size 23B
                                                                                                                                                                                                                                                                              • SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              filter_clean_schinese.txt.gz_
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_schinese.txt.gz_
                                                                                                                                                                                                                                                                              • Size 33B
                                                                                                                                                                                                                                                                              • SHA256 77f0055faba992867817c485930c5f60cf64e65c65b410128426dc35fd8d862b
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              game_details_header_green.tga_
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\steam\cached\game_details_header_green.tga_
                                                                                                                                                                                                                                                                              • Size 2.1MB
                                                                                                                                                                                                                                                                              • SHA256 a24832de8b80e206143170a899ab91e76e85685aed74963fe2f490344bbf6427
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              filter_banned_english_cached.txt
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\resource\filter_banned_english_cached.txt
                                                                                                                                                                                                                                                                              • Size 926B
                                                                                                                                                                                                                                                                              • SHA256 7fb3dd5ab03cd16e8405bd175dd312bb6244c17a9abbac83145d900fbdf96adf
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              filter_profanity_english_cached.txt
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\resource\filter_profanity_english_cached.txt
                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                              • SHA256 ce66f1c6ee1298d8e602039009e830fec9240e7e3563a50ffdafca676d7afe04
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              filter_profanity_english_cached_timestamp.txt
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\resource\filter_profanity_english_cached_timestamp.txt
                                                                                                                                                                                                                                                                              • Size 29B
                                                                                                                                                                                                                                                                              • SHA256 915224bf27867ac8865b99614ee2a9c1083a748678d52cd00cd585d19cadbb7e
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              libraryfolders.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\steamapps\libraryfolders.vdf
                                                                                                                                                                                                                                                                              • Size 231B
                                                                                                                                                                                                                                                                              • SHA256 3552c7979fdcc892371c9a3a5c9d0c08ea63a2ef6bfe790c68324d279a953c06
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              sharedconfig.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\7\remote\sharedconfig.vdf
                                                                                                                                                                                                                                                                              • Size 165B
                                                                                                                                                                                                                                                                              • SHA256 d4197cf74e5063153d8ee27b3fe36cc54b04aad5203abb01fc713cd2ef41c92d
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              remotecache.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\7\remotecache.vdf
                                                                                                                                                                                                                                                                              • Size 300B
                                                                                                                                                                                                                                                                              • SHA256 d5e556f8e03d2421870f5ef41a92b2a69fc1fc6fe48583fa6a7a226487530bc7
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              218.json
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\config\librarycache\218.json
                                                                                                                                                                                                                                                                              • Size 126B
                                                                                                                                                                                                                                                                              • SHA256 2200afe5bd5dccc0cfe9d34b29eedc49014dd673e5b9b2d1797e3f52a14b5617
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              739630.json
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\config\librarycache\739630.json
                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                              • SHA256 643fbe92b9d8dde1d867dce5f7e869ce837f29a5dd6c818df509f365813d28e2
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              licensecache.async8308.tmp
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\config\licensecache.async8308.tmp
                                                                                                                                                                                                                                                                              • Size 132B
                                                                                                                                                                                                                                                                              • SHA256 2106ab3dd7890da2a8a9bcbee6be83676ddee20ab60f2f016dd16b66540228f5
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              localconfig.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\config\localconfig.vdf
                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                              • SHA256 33364c9e2b80cb679f50c90a312c61441c2a8652fe8e354a5ac2f3284722f7ea
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              localconfig.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\config\localconfig.vdf
                                                                                                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                                                                                                              • SHA256 213b6983eea3023025527636d78f30beca7bd90d242a28c8419da98283b8cc1b
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              localconfig.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\config\localconfig.vdf
                                                                                                                                                                                                                                                                              • Size 30KB
                                                                                                                                                                                                                                                                              • SHA256 98b5289cac69521cedf99188fafa1e5fc6f5b05ed39b399d1c43cf46091407c4
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              localconfig.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\config\localconfig.vdf
                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                              • SHA256 88919a9783fc38402a1ef2d985460181e3829cd7a28c7466144ccf11fdd649c6
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              localconfig.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\config\localconfig.vdf
                                                                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                                                                              • SHA256 6a28179f364b23a17493ea15f6b5554a1d040475ad3b4293efcd6a11a9f238a5
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              localconfig.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\config\localconfig.vdf
                                                                                                                                                                                                                                                                              • Size 30KB
                                                                                                                                                                                                                                                                              • SHA256 acc646736835a499694cbe8d5adefb5677842f6ff1f8fb732e86862fb0e8d629
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              localconfig.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\config\localconfig.vdf
                                                                                                                                                                                                                                                                              • Size 30KB
                                                                                                                                                                                                                                                                              • SHA256 5f0eb313e53075c34ab3264facbb0e526a37da5f29fad08d48b77e69e2bfbf14
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              localconfig.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\config\localconfig.vdf
                                                                                                                                                                                                                                                                              • Size 30KB
                                                                                                                                                                                                                                                                              • SHA256 e273df5df6deba66e4f98e3b9efa57d24fd4d3d09f926cd6692b316b7a8f8142
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              localconfig.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\config\localconfig.vdf
                                                                                                                                                                                                                                                                              • Size 30KB
                                                                                                                                                                                                                                                                              • SHA256 c789ad07b9c76dea0cf061cd13e755652f8dafbc60209b947fac81a809ab2e52
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              localconfig.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\config\localconfig.vdf
                                                                                                                                                                                                                                                                              • Size 30KB
                                                                                                                                                                                                                                                                              • SHA256 22b3a04ff8d0ba638ee12eff9867086beb43978e6f323a48604b45df2afdf7e5
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              localconfig.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\config\localconfig.vdf
                                                                                                                                                                                                                                                                              • Size 30KB
                                                                                                                                                                                                                                                                              • SHA256 d52674e4ce5f49f681855de221fa8620a47fb7c61bbbdd9bc730d4cee83682e3
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              localconfig.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\config\localconfig.vdf
                                                                                                                                                                                                                                                                              • Size 30KB
                                                                                                                                                                                                                                                                              • SHA256 c7acef09e37366723daddc5ac7b58b05077c4e1733ba6c4fdf2490303a5284fa
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              localconfig.vdf
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\config\localconfig.vdf
                                                                                                                                                                                                                                                                              • Size 30KB
                                                                                                                                                                                                                                                                              • SHA256 3bcd3c733265fe80b796fda4ca14a6a896be53f8bacbc734f7673a25b514c72e
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              localconfig.vdf.async8864.tmp
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\config\localconfig.vdf.async8864.tmp
                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                              • SHA256 ca5993ed4c6e3716fd829b786cd3198c8ffa5ca036a771fdfad69a2c6ff23cc6
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              localconfig.vdf~RFe5f80d1.TMP
                                                                                                                                                                                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\1588658514\config\localconfig.vdf~RFe5f80d1.TMP
                                                                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                                                                              • SHA256 39ad881aecf514336df2d8fc74469caeeb63e93fbcbafb827874fce296ece023
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              CrashpadMetrics-active.pma
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\CrashpadMetrics-active.pma
                                                                                                                                                                                                                                                                              • Size 1024KB
                                                                                                                                                                                                                                                                              • SHA256 ae1bddb9e2cc97b0c9cd78ef3cd17553be6e5204677bd67e0b8f7fa27007f189
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                              • Size 40B
                                                                                                                                                                                                                                                                              • SHA256 49975b96f11bda430c7e1eec5810f2221f17b571ce12e2e24039f21df054b700
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                                              • Size 6B
                                                                                                                                                                                                                                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              BrowsingTopicsState
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                                                                                                              • Size 414B
                                                                                                                                                                                                                                                                              • SHA256 66c583d26c7da9d58b94287042bd53a35264da928bfe7d3c1796452c81158b17
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              data_0
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_0
                                                                                                                                                                                                                                                                              • Size 44KB
                                                                                                                                                                                                                                                                              • SHA256 ba2fdef07c95f07d03d4c4c583421c59ee833080c17d58aec1c289f5b6bad948
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              data_1
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_1
                                                                                                                                                                                                                                                                              • Size 264KB
                                                                                                                                                                                                                                                                              • SHA256 b3639770af730feb3032f306732fa0badc0646059109a11ef89ea8c1c14c6eb7
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              data_2
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_2
                                                                                                                                                                                                                                                                              • Size 1.0MB
                                                                                                                                                                                                                                                                              • SHA256 f695924bc4689277d4f7f5eb4425a2774c0cd60b859194d2e085346615d929cd
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              data_3
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\data_3
                                                                                                                                                                                                                                                                              • Size 4.0MB
                                                                                                                                                                                                                                                                              • SHA256 7c43159a7f2ce473915c653095cefcbc481b05980f64386b535bbd2365150fc5
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                              • Size 5KB
                                                                                                                                                                                                                                                                              • SHA256 71f91b9b4a84667c894594d5d1e379d14397f285294c2526a5305fb64367b4de
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                                                                              • SHA256 4ab1b56f6f184ea0f1c5525bbd62d58e1174677ccb76e9dd477241d2615eff27
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                                                                              • SHA256 6d1f9b35939e0e65223507cc29c46a50b50701a4217ff9a10eab083a18c55639
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                              • Size 7KB
                                                                                                                                                                                                                                                                              • SHA256 bc8614f7451148a18bc2e2ba9cbb4b6964b4d1acae72644e89854d3d38e3dc3b
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              LOG
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG
                                                                                                                                                                                                                                                                              • Size 317B
                                                                                                                                                                                                                                                                              • SHA256 7d3334059bc4029956d0ae8ae26724938dd8288d1ab1dec772016258158db066
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Favicons
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Favicons
                                                                                                                                                                                                                                                                              • Size 28KB
                                                                                                                                                                                                                                                                              • SHA256 481be60a4f2daeed1732644cf93c14e47586ed1426dc2255c71aa5eeff27d14c
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              History
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
                                                                                                                                                                                                                                                                              • Size 160KB
                                                                                                                                                                                                                                                                              • SHA256 1dabe6d1ac5dbefd0502fa2fb2b1110f0361c9a2d48176e05b092a18d09676ce
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              000003.log
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\000003.log
                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                              • SHA256 94a019cf984797311326dce8a32d9ca3f14d18f0e3a18e8dc51bfa252748d7e3
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              LOG
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG
                                                                                                                                                                                                                                                                              • Size 329B
                                                                                                                                                                                                                                                                              • SHA256 eb345b593ef2d62e23e6643734ce99ce88d03f064f8d0d58ddeb4b4eb6acde93
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Cookies
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
                                                                                                                                                                                                                                                                              • Size 20KB
                                                                                                                                                                                                                                                                              • SHA256 b81fe7e2309d027f57a5d0c9b5894b6fb124ad3c11a7da722deefcd60618f1ee
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                                                                                                              • SHA256 f625e61204926ba15b7151151c0e2d13920e6f2c52a031117db047e23c77a547
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                              • Size 27KB
                                                                                                                                                                                                                                                                              • SHA256 cbe761e31e6a0a8174f6e7dd48f7408858905fb9168bd52de708cc4879d1c517
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                              • Size 9KB
                                                                                                                                                                                                                                                                              • SHA256 bd77fd3e8eb1f72c647e2d3b7fcb2498ac4a3c5bca25e948b466ed405ce930c1
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                              • Size 7KB
                                                                                                                                                                                                                                                                              • SHA256 a03359b21e3db3d08b88e27b984c38c6b8eebe8a18ba60fa006656e8be689861
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Reporting and NEL
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Reporting and NEL
                                                                                                                                                                                                                                                                              • Size 36KB
                                                                                                                                                                                                                                                                              • SHA256 5aab1ad663be974ac088c1a322a862eb6f6f0423f09285641f8d3f04b85c16c7
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                              • Size 2B
                                                                                                                                                                                                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                              • Size 5KB
                                                                                                                                                                                                                                                                              • SHA256 b2cd0b0f3ad1566ac37a9cebf2acab4c92b7cfb8959d8a0f0eedaff0016c2771
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                              • SHA256 099979d8b23536fb46dd34339f08ce023fa019c9b0cb5670b0eea4e8ea137254
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                              • SHA256 b1bd5623d48e5a4c5d77170a8c298d3fc0f1a2eac494b4f770c71e1bdbcc5dea
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                              • SHA256 d5cee74d9014fccd9e6883ad99dae9232f7530c1798ad576861b0126468acff0
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 16KB
                                                                                                                                                                                                                                                                              • SHA256 a87cb8dea8f99d0452b72526b2d0d68e193bc5bba7db09f3dd82f1c3bb827905
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                              • SHA256 c3afc7b47ff931ab2771111b54b901199acd1721dc20638df4db6e7f14960076
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 15KB
                                                                                                                                                                                                                                                                              • SHA256 9de19d3cf80becbb92ff13aed46fa3c6f245856061b1abfeaa8502f76d167136
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 13KB
                                                                                                                                                                                                                                                                              • SHA256 6ebec833c7e0a36c2e1162a734904420e387090c7a7e7114ffc06f6fc53aadb4
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 15KB
                                                                                                                                                                                                                                                                              • SHA256 c6a1dac16052f03ab757946dfe490664da6942e25874bb5f82e50d06741b64bc
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 15KB
                                                                                                                                                                                                                                                                              • SHA256 2ef6315b82c3c9c18dd2d9c95dbfe3a353f6a6a0090fd42476a4f47eb50348c9
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 13KB
                                                                                                                                                                                                                                                                              • SHA256 ae1b55f54dd6ddd4fe472758dba08bedc4340001da5657e7810b2ab74cabfd23
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 15KB
                                                                                                                                                                                                                                                                              • SHA256 990726ce9dd8c9b5e70035c4158e7ea4ec71bf69f11d2ec0ae8d80fb55a3e7b7
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 14KB
                                                                                                                                                                                                                                                                              • SHA256 70260818fb66e2ae3021669f71c908c8c6fc2cd86f014cde98b073c763825449
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 17KB
                                                                                                                                                                                                                                                                              • SHA256 53706dc472ee1dcbdf5d07abf3121221de9155553c7c7ca8d601d7e7b784ceda
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Secure Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                              • Size 17KB
                                                                                                                                                                                                                                                                              • SHA256 2328ea9073549adab02fe99e0127dcb5999d2517b99cac1f85861fd5d1268867
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              000003.log
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000003.log
                                                                                                                                                                                                                                                                              • Size 4KB
                                                                                                                                                                                                                                                                              • SHA256 0abeedc8e60b9aec76c772b1f1a5a7dcd4c936b79c5e77bf5b00f33d668e906d
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              LOG
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\LOG
                                                                                                                                                                                                                                                                              • Size 333B
                                                                                                                                                                                                                                                                              • SHA256 51e46c36940c36b93d889c56f5f83a01922e5e68d6641b80d262c4c17d665181
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                                                                                              • Size 120B
                                                                                                                                                                                                                                                                              • SHA256 73ddf43f6369a8b703789af9e380e3a691e070cbbb8f07a8e925c82b9f991dec
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              the-real-index~RFe594879.TMP
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594879.TMP
                                                                                                                                                                                                                                                                              • Size 96B
                                                                                                                                                                                                                                                                              • SHA256 a1f93800e358ad433cc4b698c9a9432db8fb118cd9fa42ff783363c88a7b9753
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              000003.log
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log
                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                              • SHA256 cd3a9b6044e74562454337a027d051f2f4416df9dbc29e01c20c64e452b98f02
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              LOG
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG
                                                                                                                                                                                                                                                                              • Size 317B
                                                                                                                                                                                                                                                                              • SHA256 4f2e2df814a29b8363f283a56f019988e633ffd614162ecc1d2bba9aac947f74
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Tabs_13421036184661281
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sessions\Tabs_13421036184661281
                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                              • SHA256 111ca26f4869bc30c518d4c58aa653cca6f0c35b3df1fc961a85c817d1c0aed4
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                                                                                                                                                                                              • Size 72B
                                                                                                                                                                                                                                                                              • SHA256 ed07d50c22391ea057159a8550396e4d669764618313bc7a28021d2631f0f25e
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              000003.log
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log
                                                                                                                                                                                                                                                                              • Size 112B
                                                                                                                                                                                                                                                                              • SHA256 40e8a489c295a56742e5dc8ffe1512920fdfd2bbaa50e766b3f4cdbe96444d8d
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              LOG
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG
                                                                                                                                                                                                                                                                              • Size 345B
                                                                                                                                                                                                                                                                              • SHA256 791bfec377cf742d01a83ebaebe0c3ff8b8108424c33323d6b7c13475518bf50
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              LOG
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG
                                                                                                                                                                                                                                                                              • Size 324B
                                                                                                                                                                                                                                                                              • SHA256 011d332f2a1c6b3181a968a651e4a6cd5a896a7d3e7acac4372e314772de4360
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Web Data
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
                                                                                                                                                                                                                                                                              • Size 138KB
                                                                                                                                                                                                                                                                              • SHA256 fab2f74024fbfb634c9187773432488f66e54cee17205e606fc5e54b5d8a8b2a
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              QuotaManager
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager
                                                                                                                                                                                                                                                                              • Size 40KB
                                                                                                                                                                                                                                                                              • SHA256 dfa2223879331d44fb040a31dca5b9fef87ef9214bdbd51164c3cf02311f8f1d
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              QuotaManager-journal
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\QuotaManager-journal
                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                              • SHA256 21d582b7f3ac0132792fa53058e5cee4fbc84d1dae4bcb77669d1491e635d483
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              000003.log
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log
                                                                                                                                                                                                                                                                              • Size 31KB
                                                                                                                                                                                                                                                                              • SHA256 f8613b31cdb5e40dee01a3326aff90ac34c240b90b1b8f33134f956c4f09cbcc
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              LOG
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG
                                                                                                                                                                                                                                                                              • Size 320B
                                                                                                                                                                                                                                                                              • SHA256 f89e9d48a7d5774b6b21d47eb9cc1af583b62201a907649fb53781dcf395d85c
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              000003.log
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log
                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                              • SHA256 d61348bd2c30263c7cf95f5fc3561c8e543224429442d2896a68aab9424192f6
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              LOG
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG
                                                                                                                                                                                                                                                                              • Size 338B
                                                                                                                                                                                                                                                                              • SHA256 922a17fe9e490da5a638233d19627d2b80b69a220f94fbc1d0e57de12079b78a
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Last Version
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Last Version
                                                                                                                                                                                                                                                                              • Size 13B
                                                                                                                                                                                                                                                                              • SHA256 e5efa9eb104cd0b25149c2e789bec8d9aa4ba95678831b657eef7780a281c391
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                              • Size 194KB
                                                                                                                                                                                                                                                                              • SHA256 d876e2507c7b642324fef4c5ed3d3e518b749f116b134834bdfa6d2026c2c9d0
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                              • Size 109KB
                                                                                                                                                                                                                                                                              • SHA256 09ca0c55b773c1ddf985d1757062ae4cb78868b453a3e59b24b1cb1c37d9efae
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                              • Size 109KB
                                                                                                                                                                                                                                                                              • SHA256 ff0f33747b1803ae4c99fdbd3c9f37ab440a4b6ecd31435e31c0a48554133726
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                              • Size 109KB
                                                                                                                                                                                                                                                                              • SHA256 7801b1fe8279141bbe49688d2e06e4cd833640c86df446bd377b76ebc38e28af
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                              • Size 109KB
                                                                                                                                                                                                                                                                              • SHA256 31e9d9af0c596e8e0a42c7aed26449ee11328c717f3a477965f12e2c824ef0ff
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                              • Size 90KB
                                                                                                                                                                                                                                                                              • SHA256 06ec784ce19b789665cc492414e8dad88a4a1629e59be0c56a14c944414f6038
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                              • Size 109KB
                                                                                                                                                                                                                                                                              • SHA256 9796f9caf9668d98e13a728e47c660a665d8afc0b60772cbb71a1d363b46c95c
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                              • Size 109KB
                                                                                                                                                                                                                                                                              • SHA256 eeabd8b480ef5f711b9cc68e7c999b3023586ab928aa1d3366c7076efb611aae
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                              • Size 194KB
                                                                                                                                                                                                                                                                              • SHA256 04852ef3304fdbd6ee35eab7e5b632fabb1a99a1d91124e64f52c353e867b9f0
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                              • Size 109KB
                                                                                                                                                                                                                                                                              • SHA256 2f85b8c5c05b4376986041862c0e43a720d717866058a06ecb7d849f49ee4ff0
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              data_1
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                                                                                                                                                                                                                                                              • Size 264KB
                                                                                                                                                                                                                                                                              • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Variations
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Variations
                                                                                                                                                                                                                                                                              • Size 86B
                                                                                                                                                                                                                                                                              • SHA256 f7b24f2eb3d5eb0550527490395d2f61c3d2fe74bb9cb345197dad81b58b5fed
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              metadata.json
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                              • Size 13B
                                                                                                                                                                                                                                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              ukm_db
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\segmentation_platform\ukm_db
                                                                                                                                                                                                                                                                              • Size 48KB
                                                                                                                                                                                                                                                                              • SHA256 e74f7b79abb3c59d8c42712e03a03bdaeb16037b4705d1dbae0c189d69247498
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              8ed2a37f-ddd3-4460-8fc7-85daab827f51.tmp
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8ed2a37f-ddd3-4460-8fc7-85daab827f51.tmp
                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                              • SHA256 8392e99bd8b6ecc1f8d6747626a53b27178330473324bf5f63453d5ea7572e04
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                                                                              • SHA256 eacd218daf22fcefbc23ae70ce919d8ac95b89c3f7d038f647296c47a218fc46
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              settings.dat
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                              • Size 280B
                                                                                                                                                                                                                                                                              • SHA256 4f75650872d26a46dd5be1c73298a9c211c43393a9c0b309aeceec6e217486de
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_000066
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
                                                                                                                                                                                                                                                                              • Size 37KB
                                                                                                                                                                                                                                                                              • SHA256 cf0e830f6f956eca5bb6e6faf94ad3cf7c5566ef5e215d33c7fde6ce72680f0c
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_000067
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
                                                                                                                                                                                                                                                                              • Size 25KB
                                                                                                                                                                                                                                                                              • SHA256 bc40e8df05042f8e30dc60d7152fc28021a096347f157321b1a25f7013198d1c
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_000069
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
                                                                                                                                                                                                                                                                              • Size 20KB
                                                                                                                                                                                                                                                                              • SHA256 1f0fcbefe25723285516f99910453ecc1347bea9c9ca0a78ef2b39ba03fcf671
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_00006b
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
                                                                                                                                                                                                                                                                              • Size 32KB
                                                                                                                                                                                                                                                                              • SHA256 84d0be622ddeef6d0793df5d274965d6d13a756979b4b484185dc7a051eb4071
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_00006d
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
                                                                                                                                                                                                                                                                              • Size 58KB
                                                                                                                                                                                                                                                                              • SHA256 0a7faeb2d8b4845260b9bf672b749ee4e98553c26a0898b182aa38fb843499a7
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_00006e
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
                                                                                                                                                                                                                                                                              • Size 165KB
                                                                                                                                                                                                                                                                              • SHA256 d935637a73a9164d3793b6e0dd6501aa3c497b853c3fc31025c75d79724bf0ac
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_000070
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
                                                                                                                                                                                                                                                                              • Size 373KB
                                                                                                                                                                                                                                                                              • SHA256 6de718cb09d7b6eb3464f29b9a9cc72e93a9e2cfbb602b3a880c0cc9fe2ea5db
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_000072
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
                                                                                                                                                                                                                                                                              • Size 121KB
                                                                                                                                                                                                                                                                              • SHA256 045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_000075
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
                                                                                                                                                                                                                                                                              • Size 119KB
                                                                                                                                                                                                                                                                              • SHA256 19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_00007f
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
                                                                                                                                                                                                                                                                              • Size 119KB
                                                                                                                                                                                                                                                                              • SHA256 6b7a3177485c193a2e80be6269b6b12880e695a8b4349f49fccf87f9205badcc
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_000082
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
                                                                                                                                                                                                                                                                              • Size 178KB
                                                                                                                                                                                                                                                                              • SHA256 9d2f27da4267e3495150cccf599feb8706f5540ed391c5e289dcd5ee5a4479b9
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_000084
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
                                                                                                                                                                                                                                                                              • Size 115KB
                                                                                                                                                                                                                                                                              • SHA256 0adf4d5edbc82d28879fdfaaf7274ba05162ff8cbbda816d69ed52f1dae547f6
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_000085
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
                                                                                                                                                                                                                                                                              • Size 120KB
                                                                                                                                                                                                                                                                              • SHA256 d5692b785e18340807d75f1a969595bc8b1c408fb6fd63947775705e6d6baa66
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_000086
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
                                                                                                                                                                                                                                                                              • Size 91KB
                                                                                                                                                                                                                                                                              • SHA256 9d7c4f15c0b97ed4c6f2c742fe6e34719aa2a2c179b2b086016c41a589f76600
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_000087
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
                                                                                                                                                                                                                                                                              • Size 69KB
                                                                                                                                                                                                                                                                              • SHA256 a8384b989cf6a905d36a7b0028c1f6ebe2718cf24f411f96fc6b2efa137ee787
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_000088
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
                                                                                                                                                                                                                                                                              • Size 56KB
                                                                                                                                                                                                                                                                              • SHA256 53901573da958c6e4709378e307c736e2cff04a60d9492443de5f5ba9db8a79f
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_00008d
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
                                                                                                                                                                                                                                                                              • Size 63KB
                                                                                                                                                                                                                                                                              • SHA256 d84d53f0844ea7891949352990fa26299376271d926551312b2ac5a0c4a49935
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_0000a2
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
                                                                                                                                                                                                                                                                              • Size 37KB
                                                                                                                                                                                                                                                                              • SHA256 9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                              • Size 3KB
                                                                                                                                                                                                                                                                              • SHA256 aa62064bfaa9826cd8397d2ce1aa97ce457ec02fa975879043900be912ff71df
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              SiteList-Enterprise.json
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                                                                                              • Size 2B
                                                                                                                                                                                                                                                                              • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Edge Profile.ico
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                                                                                                                                                                                              • Size 70KB
                                                                                                                                                                                                                                                                              • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                              • SHA256 b7941a081bcfbac6cdea4d3d40ad457161911962d74a934594efe02ed9945f83
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 13KB
                                                                                                                                                                                                                                                                              • SHA256 e7fa08ab2c4e207c23cf9b07ece9b8c82887c182e00219b7607136c90bac492a
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Secure Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                              • Size 32KB
                                                                                                                                                                                                                                                                              • SHA256 2ce0385d2c1558faa9355aa4e3847c8f04ab25892e09fbf5af5b5cec82c4377f
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              sync_diagnostic.log
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                                                                                                              • SHA256 671e6c9188384ae96be333551727f6adf8a5aa7c35cb6ce8147c18b364aa34ec
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                              • Size 18KB
                                                                                                                                                                                                                                                                              • SHA256 54bd50d998d69f506ebaac0a44152d3bad704425e00da30da86c484b5eb42c70
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                              • SHA256 b5c92457799f52429e5945493843ca09e11f2a58df6b2cd32a90e15916cf753e
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              AppCache134210370244465907.txt
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134210370244465907.txt
                                                                                                                                                                                                                                                                              • Size 85KB
                                                                                                                                                                                                                                                                              • SHA256 84ecc143fbefc5df0b0eb71e2685e7d0822d762067133c3e12e5db91eef1e50d
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              799c26e7-5d7c-4745-add8-c6e48579c9df.tmp
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\799c26e7-5d7c-4745-add8-c6e48579c9df.tmp
                                                                                                                                                                                                                                                                              • Size 1B
                                                                                                                                                                                                                                                                              • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              f_0000bd
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_0000bd
                                                                                                                                                                                                                                                                              • Size 1.5MB
                                                                                                                                                                                                                                                                              • SHA256 4d1f5f98d7e42ba4338d0388fb386344d5c374a47d45fde1ef5b3606080f5e8f
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                              • SHA256 ff06ef157327981550b166f0d99dbd20d5c1acc50f23b97032c9e4c81eb38235
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                              • SHA256 ee37d72f66ae619f1d9757f49d58ad03de197faa1cbf11094d8eb4a45326a2ca
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                              • Size 840B
                                                                                                                                                                                                                                                                              • SHA256 c384459eb49e9170e14a177e39756de575dff6dd0ea09fd959c5e953fbdda06d
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                              • SHA256 e905176ba0b3e6010c2939b0f184887daacabd426add73f7ef757b71db5db5eb
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                              • SHA256 3452f2f13046aad3b2cc6dee0b70186b77167998e90353b8433ce5e20ed1b312
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              the-real-index
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                              • Size 288B
                                                                                                                                                                                                                                                                              • SHA256 8ba056f6248012828a1fae2ae8adbe3671c66bc157763e01c5e5baf0ea2683dd
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              the-real-index~RFe5f6172.TMP
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index~RFe5f6172.TMP
                                                                                                                                                                                                                                                                              • Size 48B
                                                                                                                                                                                                                                                                              • SHA256 597ffa581a1a850f2852a4252afdfdcb5e1c4c609943c9a663c761e3f7b6ef78
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              data_0
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_0
                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                              • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              data_2
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_2
                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                              • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              data_3
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_3
                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                              • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                              • SHA256 5b03c13c14124b6d20a58233924b2ea304ed61a51298d66813b408092fda2487
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                              • SHA256 d0300b26dbf1ea4eee932aaf06596d3e5008845d91c326f74d302a5e4f488632
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                              • SHA256 82671714443be21b6cea9dc46caffc6d55762a8c196a412d50633d662402c0f7
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Network Persistent State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                              • SHA256 151e1ccf2600e7130e59d7bc16a2a55571eea59aa524639c85c3485e6dc0c5d3
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Network Persistent State~RFe5fc750.TMP
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State~RFe5fc750.TMP
                                                                                                                                                                                                                                                                              • Size 59B
                                                                                                                                                                                                                                                                              • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                              • Size 524B
                                                                                                                                                                                                                                                                              • SHA256 d1e822b9559305e1897e3193686c378964eabdf80d72f760eab153508b01a975
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                              • Size 524B
                                                                                                                                                                                                                                                                              • SHA256 18eb41942273ff7982e208b9abb7a7f6d6005ef063399ed78cca5c95b060f6bd
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                              • Size 524B
                                                                                                                                                                                                                                                                              • SHA256 0105fb97f05c0dfe6e10936efece0c4a22df19eca35e020240c3cec083087170
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                              • Size 524B
                                                                                                                                                                                                                                                                              • SHA256 d95bfc40b0fd4f17b17d03d1e0e7aa0219d9b3c28cfbc6addc7ac99bdc11edf7
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                              • Size 524B
                                                                                                                                                                                                                                                                              • SHA256 ab7d2422ffb3017d36d584614685d7360f2c956fc3c69d9b7117edfb0114e6bf
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                              • Size 524B
                                                                                                                                                                                                                                                                              • SHA256 d432fad5179752650c61a9848d97ea24f1c7de18bfa1204984350bc30cdcfe04
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                              • Size 524B
                                                                                                                                                                                                                                                                              • SHA256 667e0f8fbe3f97127dd21f4cc579349a9c577e5462750eb66a37cf0b4396c030
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                              • Size 524B
                                                                                                                                                                                                                                                                              • SHA256 1090227293e3351d539951e2a999184b41bb4902f4a5636bf9030195f32b0b3e
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                              • Size 524B
                                                                                                                                                                                                                                                                              • SHA256 46cb2f358a912f14bee731ad2f2d5bae9ab3f3539cc22657dd730494d3b9ecf7
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                              • Size 524B
                                                                                                                                                                                                                                                                              • SHA256 ff407f12dd9b454586833ff17befa39ccb3ccf0f776cbb9f845d64cea4414158
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                              • Size 524B
                                                                                                                                                                                                                                                                              • SHA256 93608031ccb956cc0db05281609e3e850bb4a9ebc5b30fcffb02ccf0fcdce3f4
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                              • Size 522B
                                                                                                                                                                                                                                                                              • SHA256 ee4c7e1922953c842fb37acacde19c1240de4bd024cc298575b1c644d8016d9b
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              TransportSecurity
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                              • Size 524B
                                                                                                                                                                                                                                                                              • SHA256 953b384676c0cb7913a7431031786590697d7c4928c273de2769d306424d903d
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              TransportSecurity~RFe5fb62a.TMP
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity~RFe5fb62a.TMP
                                                                                                                                                                                                                                                                              • Size 188B
                                                                                                                                                                                                                                                                              • SHA256 efc54acdca2fabb1c92b70eb0503ef24657d03b551bf69399d233133e5f94496
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                              • SHA256 d2b179e513a88050b33ecd5e58dcdc063c27548832204c2905b0956707d97084
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                              • SHA256 536a478afab2aa267638f8d6467912e5ac7ce3047a1972d08a107bec41e841ed
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                              • SHA256 15daf67924b31e1a5256badc80237484f5bc26b99d8f982702675b979355f304
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                              • SHA256 96c98ee0e1876313df3fc3fe84991dab7ae7e843f0d6d5321d166e1ae474005c
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                              • SHA256 702c01846bf5eb95fb6d13d9838851540e5cba2e7ae1d15018f7f564e38cc2f5
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                              • SHA256 a1601f933556bb904d42329f86380d21b6dc8a2c320ccceaaa9b7542da14ae15
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                              • SHA256 0adcebcd63ea4684ef55f01cfac1d66b23ff44caa57a2aa9f6a50e2d6242348c
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                              • SHA256 a70c671dc311af32685bf9e96286f31f6f6d792d8e143fe51dcc27730e4f6a67
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 7KB
                                                                                                                                                                                                                                                                              • SHA256 9b3e0415fbd444360da050a85f945f3f38cda8cb9aec0c3a2337c527dc2cedc5
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 7KB
                                                                                                                                                                                                                                                                              • SHA256 912cf7f1bbf06d3720bc41ea54863226c64115059d3dc6d2d0347fb0c89ad39a
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                                                                                                                                                                                              • Size 8KB
                                                                                                                                                                                                                                                                              • SHA256 de2b5daf094c61ba0e3b4387555115a8744ad72623b06e57d44272f4ae623349
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Preferences~RFe5f6867.TMP
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences~RFe5f6867.TMP
                                                                                                                                                                                                                                                                              • Size 7KB
                                                                                                                                                                                                                                                                              • SHA256 666785839df505fb74c9fab2e3c9f6404aa768fd95fd0dd8e24e6630f01c1bf2
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              CURRENT
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Site Characteristics Database\CURRENT
                                                                                                                                                                                                                                                                              • Size 16B
                                                                                                                                                                                                                                                                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              MANIFEST-000001
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\shared_proto_db\metadata\MANIFEST-000001
                                                                                                                                                                                                                                                                              • Size 41B
                                                                                                                                                                                                                                                                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                              • SHA256 5aaf1e40ff1ac1b7d6d813456afca0a957f750685f543f781d502c71e892b162
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                              • SHA256 f24d3ef471248bc9dc369f4f52db4adede7e9f5b310b508e8d108e6e09e1bde5
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                              • SHA256 76dd8a2f4b24e3abb324267d90383916c3efa2be61a1546cc4708385d1290675
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                              • SHA256 3d6fe1bf3f41930669d700381ba935f58db105a24494f11752e6aa24dceba32e
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                              • SHA256 a387e947925901eb734c28994b443538cab466e7f4f96ad121410ebb6677616d
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                              • SHA256 e1fd04dc09df1333151af6e0baf795c3c954739d03afa5fa98a3b1e23d6064dc
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                              • SHA256 9c1b86bbf983b6ce6031c4ed090244e20075c3a81c4ef766169e7e7add7b1e59
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                              • SHA256 cbb9477a68c4e2e2df0310cbc8a2d53fa566742fc6b3954818bb1720b473beb0
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                              • SHA256 5e95ef961f1a5b5dd8a66a87ec4a31cf17d1a245ba6e5255bbc491d9b8cc4a38
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                              • SHA256 d341b7e425d4e0ae6272416638c0689f98520908b80e315806bd0fdaa823239f
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                              • SHA256 495b7ba63081e4e37f2dc744b5bdc943c5f9400626223a0a7516cc73d5410df2
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                                                                                                                                                                                              • Size 2KB
                                                                                                                                                                                                                                                                              • SHA256 21ee90ebf02e86411a59705a4227b5db1ed886fae24974098261ac0915636f21
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                              • SHA256 d491a7176a2758a8741406d3133cb120e6029fa73eff4602aa5d465265fbf0a3
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Local State~RFe5ef971.TMP
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State~RFe5ef971.TMP
                                                                                                                                                                                                                                                                              • Size 890B
                                                                                                                                                                                                                                                                              • SHA256 8da151a37890950d20482519c2d035de90da688a1f94692ad41b16dd9aa844ac
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Variations
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Variations
                                                                                                                                                                                                                                                                              • Size 85B
                                                                                                                                                                                                                                                                              • SHA256 b26da4f8c7e283aa74386da0229d66af14a37986b8ca828e054fc932f68dd557
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              __PSScriptPolicyTest_bwaadski.4lh.ps1
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bwaadski.4lh.ps1
                                                                                                                                                                                                                                                                              • Size 60B
                                                                                                                                                                                                                                                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              System.dll
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nswE42F.tmp\System.dll
                                                                                                                                                                                                                                                                              • Size 12KB
                                                                                                                                                                                                                                                                              • SHA256 9d81c2e901e59350e33f0c33f44e033e727a4d962e245ecb23561da8feccdfad
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              modern-wizard.bmp
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nswE42F.tmp\modern-wizard.bmp
                                                                                                                                                                                                                                                                              • Size 150KB
                                                                                                                                                                                                                                                                              • SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              nsExec.dll
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nswE42F.tmp\nsExec.dll
                                                                                                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                                                                                                              • SHA256 a22e9b6a0d511872cd572fe5758026a26e90ee3f19fa992a02abe4f6d34f5535
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              nsDialogs.dll
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nsxA55D.tmp\nsDialogs.dll
                                                                                                                                                                                                                                                                              • Size 20KB
                                                                                                                                                                                                                                                                              • SHA256 91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              nsExec.dll
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nsxA55D.tmp\nsExec.dll
                                                                                                                                                                                                                                                                              • Size 17KB
                                                                                                                                                                                                                                                                              • SHA256 3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              nsProcess.dll
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nsxA55D.tmp\nsProcess.dll
                                                                                                                                                                                                                                                                              • Size 15KB
                                                                                                                                                                                                                                                                              • SHA256 bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              default.dic
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                                                                                                                                              • Size 2B
                                                                                                                                                                                                                                                                              • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                                              • SHA256 12d0ac6bd37c12077c70d8a790b0ce6fcb23b4ae30f3df53fd3589f33a297372
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                                              • SHA256 53faab7f0d45a12ac4ebf90e2455427f0c84efba3c98d11cc5f2559aa2fed6e5
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                                              • SHA256 dce74854cb3056ef043044a8b9c728ff98bd919faa898a0f6c9ad82b597e720a
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                                              • SHA256 03c57f1803640bcaf12821d596edcbd2f9ff9b6c648e9157dab0cf7e8a22e45e
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                                                                                                              • SHA256 3db35091ec74a05c67163b7fa07c5ce482969d04278fa8f482eebed86b52efc7
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                                              • SHA256 20278ee51351b3eeb8a024b8431019077b700405034457e3c6340930d6ee524a
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                                                                                                              • SHA256 ad7d27d0212eb9a6380dcd15359884a8410119f65fc693c14dad51fcd3916ea6
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                                                                                                              • SHA256 8b1c845f5fe43c1403be801a40d6516b18fcd68cb2959d2279bb1c2bced050b4
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                                              • SHA256 158c68e870d9ac121a9a4c8052279e264ec6ba675252a57a0ae5227f108768fd
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                                              • SHA256 b947606be54a5c5854e86e30c0d57f0995e43287cc42d7ef1378d0828456b28c
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                                              • SHA256 30111230031b0fe5b6bdd159c43211f8b686fafcad8b80bb4cb43d1b0718c00a
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                                              • SHA256 58df12110a92ab992a4cef8267b72920286eaef065438764522e20392a5171f0
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Size 6KB
                                                                                                                                                                                                                                                                              • SHA256 2ca9cce7fb037a23af21aa4eb91605f46518d64eb8bb5cdaf59e8b767c651d93
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                                              • SHA256 2224d4f023116f70ec29195a46b598ad3a3f3729213c1796c786b33105443c09
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                                                                                                                                                                                              • Size 11KB
                                                                                                                                                                                                                                                                              • SHA256 ced5efe6a0a7f4751c8ba15baecef595e173b443d927ff6d44a88b6b8be511b5
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              DepotDownloader-windows-x64.zip
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Downloads\DepotDownloader-windows-x64.zip
                                                                                                                                                                                                                                                                              • Size 31.9MB
                                                                                                                                                                                                                                                                              • SHA256 41c9e9f0df54b3ad02e67a11726756e5c73283bd7c2e1b04acfa5ae4c2ed3767
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              DepotDownloader-windows-x64.zip:Zone.Identifier
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Downloads\DepotDownloader-windows-x64.zip:Zone.Identifier
                                                                                                                                                                                                                                                                              • Size 1KB
                                                                                                                                                                                                                                                                              • SHA256 284b7bc43f89e3e39aa3f8c2dc914f1abe292261004d08715155b08973085bd2
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Unconfirmed 438700.crdownload
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Downloads\Unconfirmed 438700.crdownload
                                                                                                                                                                                                                                                                              • Size 2.3MB
                                                                                                                                                                                                                                                                              • SHA256 7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              Unconfirmed 623258.crdownload
                                                                                                                                                                                                                                                                              • Path C:\Users\Admin\Downloads\Unconfirmed 623258.crdownload
                                                                                                                                                                                                                                                                              • Size 10.6MB
                                                                                                                                                                                                                                                                              • SHA256 41ec92bc311daf40b22b2497d044b12d9ba0266da84d8581255d7cc9e059135f
                                                                                                                                                                                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                              Submit Download

                                                                                                                                                                                                                                                                              memory/396-537-0x000001F2AFE40000-0x000001F2AFEEF000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/396-599-0x000001F2AFE40000-0x000001F2AFEEF000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/564-876-0x00007FFE39550000-0x00007FFE39A91000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1668-1466-0x00000000011B0000-0x000000000126B000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1788-7835-0x0000000000A50000-0x0000000000B0B000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1788-1475-0x0000000000A50000-0x0000000000B0B000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1788-7803-0x0000000000A50000-0x0000000000B0B000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/1892-650-0x0000024AB3F90000-0x0000024AB403F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2024-1449-0x00000000018B0000-0x000000000196B000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2496-506-0x0000014B6A380000-0x0000014B6A42F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2496-877-0x00000000026F0000-0x000000000279F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2496-1487-0x00000000026F0000-0x000000000279F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2628-518-0x000002A7B8CA0000-0x000002A7B8D16000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2628-531-0x000002A7B8F00000-0x000002A7B8F1A000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2628-538-0x000002A7A0060000-0x000002A7A010F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2628-539-0x000002A7A0110000-0x000002A7A0122000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2628-517-0x000002A7B8BD0000-0x000002A7B8C16000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2628-516-0x000002A7B8790000-0x000002A7B87B2000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2628-526-0x000002A7B8C40000-0x000002A7B8C5C000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2628-527-0x000002A7B8E20000-0x000002A7B8ED3000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2628-597-0x000002A7A0060000-0x000002A7A010F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2628-534-0x000002A7B8EF0000-0x000002A7B8EFA000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2628-528-0x000002A7B8860000-0x000002A7B886A000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2628-529-0x000002A7B8C80000-0x000002A7B8C9C000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2628-530-0x000002A7B8C60000-0x000002A7B8C6A000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2628-519-0x000002A7B8C20000-0x000002A7B8C3E000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2628-532-0x000002A7B8C70000-0x000002A7B8C78000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/2628-533-0x000002A7B8EE0000-0x000002A7B8EE6000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3508-13-0x0000022C00CB0000-0x0000022C00D5F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3636-541-0x000002043B7C0000-0x000002043B86F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3636-505-0x000002043B7C0000-0x000002043B86F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3832-884-0x0000013D1F270000-0x0000013D1F31F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3960-7809-0x0000000000360000-0x0000000000812000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3960-7811-0x0000000002B80000-0x0000000002B87000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3960-1485-0x0000000005220000-0x0000000005245000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3960-1483-0x00000000011A0000-0x000000000125B000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3960-1484-0x0000000002B80000-0x0000000002B87000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3960-7715-0x00000000011A0000-0x000000000125B000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/3960-7812-0x0000000005220000-0x0000000005245000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4496-874-0x00007FFE39550000-0x00007FFE39A91000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4496-878-0x000002109FF30000-0x000002109FFDF000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/4724-875-0x0000000002DD0000-0x0000000002E7F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5020-873-0x0000000000940000-0x00000000009EF000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/5200-15275-0x0000023020A30000-0x0000023020ADF000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/8180-15433-0x000001B314790000-0x000001B3147ED000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/8180-15432-0x000001B3146D0000-0x000001B31477F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/8180-14528-0x000001B314790000-0x000001B3147ED000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/8180-14527-0x000001B3146D0000-0x000001B31477F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/8864-14526-0x00000187364A0000-0x000001873654F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/10068-14220-0x00007FFE58FF0000-0x00007FFE58FF1000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/10068-14221-0x00007FFE59920000-0x00007FFE59921000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/11588-14324-0x0000000001480000-0x0000000001487000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/11588-14323-0x0000000000F20000-0x0000000000FDB000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/12928-14417-0x0000000001150000-0x000000000120B000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/12992-14544-0x0000000000910000-0x00000000009CB000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/12992-14545-0x0000000000E70000-0x0000000000E77000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/12992-15438-0x0000000000910000-0x00000000009CB000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/12992-14968-0x0000000000910000-0x00000000009CB000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/12992-15439-0x0000000000E70000-0x0000000000E77000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/12992-14588-0x0000000000910000-0x00000000009CB000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/14028-14556-0x000002B634950000-0x000002B6349FF000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/14180-14446-0x000001EEAE1E0000-0x000001EEAE28F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/14828-14557-0x000002BF84AD0000-0x000002BF84B7F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/15704-14506-0x00000228961E0000-0x000002289628F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/20992-14975-0x000001B3B99F0000-0x000001B3B9A9F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/21628-15135-0x000001302CE50000-0x000001302CEFF000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/22868-15169-0x000001F573AD0000-0x000001F573B7F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/23788-15443-0x000001FC09BD0000-0x000001FC09C7F000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/28268-14172-0x0000000005760000-0x0000000005785000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/28268-7842-0x0000000004E90000-0x0000000004E97000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/28268-7843-0x0000000005760000-0x0000000005785000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/28268-14073-0x0000000001530000-0x00000000015EB000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/28268-14170-0x0000000001530000-0x00000000015EB000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/28268-7841-0x0000000001530000-0x00000000015EB000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/28268-14171-0x0000000004E90000-0x0000000004E97000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/28268-14169-0x0000000000CB0000-0x00000000011B9000-memory.dmp
                                                                                                                                                                                                                                                                              Download

                                                                                                                                                                                                                                                                              memory/28420-7822-0x00000000012C0000-0x000000000137B000-memory.dmp
                                                                                                                                                                                                                                                                              Download