992d547bbf83f26f3117b27aaa2a2e2e665f76658b67c27e84b13dc379833eaa

Analysis

user interaction
yes
max time kernel
569s
max time network
574s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
12/07/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SteamTools.exe
Size 1.7MB
Sample260712-2bbchsht7q
SHA256 992d547bbf83f26f3117b27aaa2a2e2e665f76658b67c27e84b13dc379833eaa
MD5 9ab2a4fa1b4da8db2e102c0fcba6e5f0
SHA1 a1b85c90f9f3717570448bab83d9ba103cb31a13
SHA512 acd2445a4351e9a1e04caa574631ae8480386d411adbd7b74af24085c85fcdc487f0f90432e496b3fe47258d6bf21a74c1f9f001b006ad4912c4e432129eadbb
SSDEEP 24576:X5vF+/wYyf1jXjBHT0SMSnVpcZuphOH7q9r/bWYAo3P:5F+/wYU1jtIKKZupaqhz0E
TLSH
T1BF857D0BB278C1FDD067C179C51A9A0BDA717446172196DF22908AA53F33BE21E7F368
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Renames multiple (6142) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
237	13500	powershell.exe
238	13500	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
218	12656	chrome.exe
89	1472	chrome.exe

Executes dropped EXE 41 IoCs

pid	Process
3884	SteamSetup.exe
3436	steamservice.exe
2064	Steam.exe
272	steamservice.exe
4840	Steam.exe
3024	Steam.exe
19248	Steam.exe
12320	steamsysinfo.exe
3328	steamwebhelper.exe
7212	steamwebhelper.exe
16164	steamservice.exe
16372	steamwebhelper.exe
7340	steamwebhelper.exe
2668	steamwebhelper.exe
4404	SteamServiceTmp.exe
724	steamservice.exe
3032	gldriverquery64.exe
6236	steamwebhelper.exe
15872	gldriverquery.exe
15896	vulkandriverquery64.exe
16196	vulkandriverquery.exe
6464	steamwebhelper.exe
21200	steamwebhelper.exe
12136	st-setup-1.8.30.exe
11608	SteamTools.exe
8476	steam.exe
8524	steam.exe
8536	steam.exe
1988	steamsysinfo.exe
21524	steamwebhelper.exe
21552	steamwebhelper.exe
21664	steamservice.exe
21052	steamwebhelper.exe
21788	steamwebhelper.exe
21868	steamwebhelper.exe
7068	gldriverquery64.exe
7108	steamwebhelper.exe
7668	gldriverquery.exe
7692	vulkandriverquery64.exe
7812	vulkandriverquery.exe
18752	steamwebhelper.exe

Loads dropped DLL 64 IoCs

pid	Process
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3024	Steam.exe
19248	Steam.exe
19248	Steam.exe
19248	Steam.exe
19248	Steam.exe
19248	Steam.exe
19248	Steam.exe
19248	Steam.exe
19248	Steam.exe
19248	Steam.exe
19248	Steam.exe
19248	Steam.exe
19248	Steam.exe
19248	Steam.exe
19248	Steam.exe
19248	Steam.exe
19248	Steam.exe
12320	steamsysinfo.exe
12320	steamsysinfo.exe
12320	steamsysinfo.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
7212	steamwebhelper.exe
7212	steamwebhelper.exe
7212	steamwebhelper.exe
7212	steamwebhelper.exe
16372	steamwebhelper.exe
16372	steamwebhelper.exe
16372	steamwebhelper.exe
16372	steamwebhelper.exe
16372	steamwebhelper.exe
16372	steamwebhelper.exe
16372	steamwebhelper.exe
16372	steamwebhelper.exe
16372	steamwebhelper.exe
16372	steamwebhelper.exe
16372	steamwebhelper.exe
7340	steamwebhelper.exe
7340	steamwebhelper.exe
7340	steamwebhelper.exe
7340	steamwebhelper.exe
2668	steamwebhelper.exe
2668	steamwebhelper.exe
2668	steamwebhelper.exe
2668	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
724	steamservice.exe
724	steamservice.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
11920	icacls.exe
11864	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent"	SteamSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_74B0F1158CF3BBDE3B65AF739E904359	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141	steamservice.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_74B0F1158CF3BBDE3B65AF739E904359	steamservice.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\package\tmp\public\steam_updating_posix.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\xbox_one_romanian.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\d0ggle.bin_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps5_trackpad_l_click.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\9779.js_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\public\steambootstrapper_german.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_outlined_button_a_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps_color_button_square_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps5_trackpad_l_ring_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps5_trackpad_l_right_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sd_r2_half_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\cloud_localfiles.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_back_disabled.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\switchpro_lstick_click_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps5_l2_soft_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\gameproperties_shortcuts.res_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\controller_config_controller_switch_joycon_right.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\localization\xbox_360_koreana.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\chkselfocus_sm.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\minithrobber01.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps5_trackpad_r_up_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sc_button_l_arrow_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_lstick_right_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\xbox360_button_start.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\bins_webhelpers_win64.zip.vz.f52233c447eb51b2e71f95d4e151ce0bcbe4f159_2729850	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_100_target_0110.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_030_inv_0120.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\ps_color_button_x.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\sd_ltrackpad_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps5_trackpad_right.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\shared_rstick_click_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps4_trackpad_r_swipe.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps4_r2_soft_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps5_button_create.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\sc_lg_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\hp_m1_sm-1.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_lb_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_040_act_0321.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_rg.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_gyro_pitch_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_lstick_down_md.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_sl_sm.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\friends\broadcastinvitebar.res_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_035_magic_0360.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\shared_rstick_left_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\icon_friendslist_over.tga_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\platform_swedish.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steam\cached\steamui_postlogon_finnish.txt_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\switchpro_button_c.svg_	Steam.exe
File created	C:\Program Files (x86)\Common Files\Steam\crashhandler.dll.new	steamservice.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_035_magic_0334.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\resource\dlc_installed.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\ps5_trackpad_r_down.svg_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\dark\sc_touchpad_down_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\friends\friendnotificationoptionsdialog.res_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\tenfoot\resource\images\library\controller\binding_icons\ghost_100_target_0170.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_060_vehicle_0070.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\steamui\images\controller\ghost_100_target_0020.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\broadcast\icon_mic_off.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\light\ps_color_button_circle_lg.png_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\win64\chromehtml.dll_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tmp\controller_base\images\api\knockout\shared_lstick_right.svg_	Steam.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 2 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\st-setup-1.8.30.exe:Zone.Identifier	chrome.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Steam.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gldriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vulkandriverquery.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe

System Time Discovery 1 TTPs 5 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
7340	steamwebhelper.exe
12656	chrome.exe
21788	steamwebhelper.exe
18072	chrome.exe
1472	chrome.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	steam.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	chrome.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	steam.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	steam.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	chrome.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Steam.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Steam.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Steam.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamservice.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamservice.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamservice.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Steam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamservice.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	steamservice.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe

Enumerates system info in registry 2 TTPs 15 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	steamwebhelper.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	steamwebhelper.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	steamwebhelper.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	steamservice.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	steamservice.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	steamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	steamservice.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\steamlink	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	steamservice.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	steamservice.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	steamwebhelper.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\steam	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	steamservice.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\steam\Shell\Open\Command\ = "\"C:\\program files (x86)\\steam\\steam.exe\" -- \"%1\""	steamservice.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{2EC08997-13CF-4690-B370-91AE8656D51A}	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\steam\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\program files (x86)\\steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\steamlink	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\program files (x86)\\steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\steamlink\Shell\Open	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Steam.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\st-setup-1.8.30.exe:Zone.Identifier	chrome.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
5068	SteamTools.exe
11608	SteamTools.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5664	chrome.exe
5664	chrome.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
3884	SteamSetup.exe
5664	chrome.exe
5664	chrome.exe
19248	Steam.exe
19248	Steam.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
724	steamservice.exe
724	steamservice.exe
19248	Steam.exe
19248	Steam.exe
19248	Steam.exe
19248	Steam.exe
19248	Steam.exe
19248	Steam.exe
21200	steamwebhelper.exe
21200	steamwebhelper.exe
19084	chrome.exe
19084	chrome.exe
13500	powershell.exe
13500	powershell.exe
13500	powershell.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
8536	steam.exe
8536	steam.exe
21524	steamwebhelper.exe
21524	steamwebhelper.exe
11608	SteamTools.exe
11608	SteamTools.exe
21664	steamservice.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
5068	SteamTools.exe
19248	Steam.exe
11608	SteamTools.exe
8536	steam.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
684	Process not Found
684	Process not Found
684	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 49 IoCs

pid	Process
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
19084	chrome.exe
19084	chrome.exe
19084	chrome.exe
19084	chrome.exe
19084	chrome.exe
19084	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe
Token: SeShutdownPrivilege	5664	chrome.exe
Token: SeCreatePagefilePrivilege	5664	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5068	SteamTools.exe
5068	SteamTools.exe
5068	SteamTools.exe
5068	SteamTools.exe
5068	SteamTools.exe
5068	SteamTools.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5068	SteamTools.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5068	SteamTools.exe
5068	SteamTools.exe
5068	SteamTools.exe
5068	SteamTools.exe
5068	SteamTools.exe
5068	SteamTools.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5664	chrome.exe
5068	SteamTools.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
3328	steamwebhelper.exe
19084	chrome.exe
19084	chrome.exe
19084	chrome.exe
19084	chrome.exe
19084	chrome.exe
19084	chrome.exe
19084	chrome.exe
19084	chrome.exe
19084	chrome.exe
19084	chrome.exe
19084	chrome.exe
19084	chrome.exe
19084	chrome.exe
19084	chrome.exe
19084	chrome.exe
19084	chrome.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
21524	steamwebhelper.exe
21524	steamwebhelper.exe
21524	steamwebhelper.exe
21524	steamwebhelper.exe
21524	steamwebhelper.exe
21524	steamwebhelper.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe
18456	chrome.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
5068	SteamTools.exe
5068	SteamTools.exe
5068	SteamTools.exe
5068	SteamTools.exe
19248	Steam.exe
19512	MiniSearchHost.exe
11644	WindowsTerminal.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
11608	SteamTools.exe
8536	steam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5664 wrote to memory of 1340	5664	chrome.exe	81
PID 5664 wrote to memory of 2084	5664	chrome.exe	82
PID 5664 wrote to memory of 2084	5664	chrome.exe	82
PID 5664 wrote to memory of 1472	5664	chrome.exe	83
PID 5664 wrote to memory of 6124	5664	chrome.exe	84
PID 5664 wrote to memory of 6124	5664	chrome.exe	84
PID 5664 wrote to memory of 4872	5664	chrome.exe	85
PID 5664 wrote to memory of 4872	5664	chrome.exe	85
PID 5664 wrote to memory of 5148	5664	chrome.exe	86
PID 5664 wrote to memory of 5148	5664	chrome.exe	86
PID 5664 wrote to memory of 3920	5664	chrome.exe	88
PID 5664 wrote to memory of 3920	5664	chrome.exe	88
PID 5664 wrote to memory of 5172	5664	chrome.exe	90
PID 5664 wrote to memory of 5172	5664	chrome.exe	90
PID 5664 wrote to memory of 1788	5664	chrome.exe	91
PID 5664 wrote to memory of 3628	5664	chrome.exe	94
PID 5664 wrote to memory of 3628	5664	chrome.exe	94
PID 5664 wrote to memory of 1196	5664	chrome.exe	95
PID 5664 wrote to memory of 1196	5664	chrome.exe	95
PID 5664 wrote to memory of 3736	5664	chrome.exe	96
PID 5664 wrote to memory of 3736	5664	chrome.exe	96
PID 5664 wrote to memory of 5324	5664	chrome.exe	97
PID 5664 wrote to memory of 5360	5664	chrome.exe	98
PID 5664 wrote to memory of 3864	5664	chrome.exe	99
PID 5664 wrote to memory of 1548	5664	chrome.exe	100
PID 5664 wrote to memory of 1548	5664	chrome.exe	100
PID 5664 wrote to memory of 3872	5664	chrome.exe	101
PID 5664 wrote to memory of 3884	5664	chrome.exe	102
PID 3884 wrote to memory of 3436	3884	SteamSetup.exe	103
PID 4840 wrote to memory of 3024	4840	Steam.exe	111
PID 3024 wrote to memory of 19248	3024	Steam.exe	112
PID 19248 wrote to memory of 12320	19248	Steam.exe	113
PID 19248 wrote to memory of 3328	19248	Steam.exe	115
PID 3328 wrote to memory of 7212	3328	steamwebhelper.exe	116
PID 3328 wrote to memory of 16372	3328	steamwebhelper.exe	118
PID 3328 wrote to memory of 16372	3328	steamwebhelper.exe	118
PID 3328 wrote to memory of 7340	3328	steamwebhelper.exe	119
PID 3328 wrote to memory of 2668	3328	steamwebhelper.exe	120
PID 3328 wrote to memory of 2668	3328	steamwebhelper.exe	120
PID 16164 wrote to memory of 4404	16164	steamservice.exe	121
PID 19248 wrote to memory of 3032	19248	Steam.exe	126
PID 3328 wrote to memory of 6236	3328	steamwebhelper.exe	128
PID 3328 wrote to memory of 6236	3328	steamwebhelper.exe	128
PID 19248 wrote to memory of 15872	19248	Steam.exe	129
PID 19248 wrote to memory of 15896	19248	Steam.exe	130
PID 19248 wrote to memory of 16196	19248	Steam.exe	132
PID 3328 wrote to memory of 6464	3328	steamwebhelper.exe	135
PID 3328 wrote to memory of 21200	3328	steamwebhelper.exe	147
PID 19084 wrote to memory of 19136	19084	chrome.exe	149
PID 19084 wrote to memory of 19148	19084	chrome.exe	150
PID 19084 wrote to memory of 19148	19084	chrome.exe	150
PID 19084 wrote to memory of 12656	19084	chrome.exe	151
PID 19084 wrote to memory of 12728	19084	chrome.exe	152
PID 19084 wrote to memory of 12728	19084	chrome.exe	152
PID 19084 wrote to memory of 13008	19084	chrome.exe	153
PID 19084 wrote to memory of 13008	19084	chrome.exe	153
PID 19084 wrote to memory of 19132	19084	chrome.exe	154
PID 19084 wrote to memory of 19132	19084	chrome.exe	154
PID 19084 wrote to memory of 14508	19084	chrome.exe	157
PID 19084 wrote to memory of 14508	19084	chrome.exe	157
PID 19084 wrote to memory of 14252	19084	chrome.exe	158
PID 19084 wrote to memory of 14064	19084	chrome.exe	160
PID 19084 wrote to memory of 14064	19084	chrome.exe	160
PID 19084 wrote to memory of 13840	19084	chrome.exe	161

C:\Users\Admin\AppData\Local\Temp\SteamTools.exe
"C:\Users\Admin\AppData\Local\Temp\SteamTools.exe"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5068

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff866b0c728,0x7ff866b0c734,0x7ff866b0c740
  2⤵
  PID:1340
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,10237629835579258696,5300096198564375181,262144 --field-trial-handle=1964,i,8370979274152669350,10403961841861878986,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:2084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1512,i,16066001972249302941,7153134598039610143,524288 --field-trial-handle=1964,i,8370979274152669350,10403961841861878986,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2244 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,13811786795531322187,8980318884302023803,524288 --field-trial-handle=1964,i,8370979274152669350,10403961841861878986,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2400 /prefetch:13
  2⤵
  PID:6124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,17268630323634528043,3841565667247938472,2097152 --field-trial-handle=1964,i,8370979274152669350,10403961841861878986,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3364,i,7725315066897608216,7624714409877800466,2097152 --field-trial-handle=1964,i,8370979274152669350,10403961841861878986,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:5148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4340,i,7935106878221099189,10215977583534212140,2097152 --field-trial-handle=1964,i,8370979274152669350,10403961841861878986,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4368 /prefetch:9
  2⤵
  PID:3920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4784,i,505949252000356428,4029965627956486206,2097152 --field-trial-handle=1964,i,8370979274152669350,10403961841861878986,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,8324540940398516758,4602521561963371099,524288 --field-trial-handle=1964,i,8370979274152669350,10403961841861878986,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:1788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5840,i,3264085285507171066,10337753721697296207,2097152 --field-trial-handle=1964,i,8370979274152669350,10403961841861878986,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3524,i,893500652541186720,12107439864056622270,2097152 --field-trial-handle=1964,i,8370979274152669350,10403961841861878986,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3680,i,466414097482082004,4685784987243546081,2097152 --field-trial-handle=1964,i,8370979274152669350,10403961841861878986,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,1509849789761922460,12906012649815655105,524288 --field-trial-handle=1964,i,8370979274152669350,10403961841861878986,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5744 /prefetch:14
  2⤵
  PID:5324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,301418307935777003,16820851905268165842,524288 --field-trial-handle=1964,i,8370979274152669350,10403961841861878986,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5572 /prefetch:14
  2⤵
  PID:5360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4840,i,11610135740521243142,8899460211711414369,524288 --field-trial-handle=1964,i,8370979274152669350,10403961841861878986,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4824 /prefetch:14
  2⤵
  PID:3864
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=4396,i,4339469570696679405,1515222084806271332,2097152 --field-trial-handle=1964,i,8370979274152669350,10403961841861878986,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5540,i,17688705847119555596,7501511968175216174,524288 --field-trial-handle=1964,i,8370979274152669350,10403961841861878986,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4376 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:3872
- C:\Users\Admin\Downloads\SteamSetup.exe
  "C:\Users\Admin\Downloads\SteamSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3884
- - C:\Program Files (x86)\Steam\bin\steamservice.exe
    "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3436

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6120

C:\Program Files (x86)\Steam\Steam.exe
"C:\Program Files (x86)\Steam\steam.exe" -silent
1⤵
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
PID:2064

C:\Program Files (x86)\Common Files\Steam\steamservice.exe
"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:272

C:\Program Files (x86)\Steam\Steam.exe
"C:\Program Files (x86)\Steam\Steam.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files (x86)\Steam\Steam.exe
  "C:\Program Files (x86)\Steam\Steam.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of WriteProcessMemory
  PID:3024
- - C:\Program Files (x86)\Steam\Steam.exe
    "C:\Program Files (x86)\Steam\Steam.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks SCSI registry key(s)
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:19248
  - - C:\Program Files (x86)\Steam\steamsysinfo.exe
      "C:\Program Files (x86)\Steam\steamsysinfo.exe" -steamid 0 -buildid 1782866176 -logdir "C:\Program Files (x86)\Steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\2E7A.tmp
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:12320
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=19248" "-buildid=1782866176" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks processor information in registry
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3328
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1782866176 --initial-client-data=0x290,0x294,0x298,0x28c,0x29c,0x7ff8566baea0,0x7ff8566baeac,0x7ff8566baeb8
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:7212
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1840,i,7053874648005769782,17129243224057228148,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1844 --mojo-platform-channel-handle=1832 /prefetch:2
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:16372
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --field-trial-handle=2124,i,7053874648005769782,17129243224057228148,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2188 --mojo-platform-channel-handle=2184 /prefetch:11
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Time Discovery
        
        PID:7340
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --field-trial-handle=2288,i,7053874648005769782,17129243224057228148,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2508 --mojo-platform-channel-handle=2504 /prefetch:13
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:2668
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3984,i,7053874648005769782,17129243224057228148,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4004 --mojo-platform-channel-handle=4000 /prefetch:1
        5⤵
        Executes dropped EXE
        
        PID:6236
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --field-trial-handle=4776,i,7053874648005769782,17129243224057228148,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4744 --mojo-platform-channel-handle=4740 /prefetch:14
        5⤵
        Executes dropped EXE
        
        PID:6464
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=640,i,7053874648005769782,17129243224057228148,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4636 --mojo-platform-channel-handle=4744 /prefetch:10
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:21200
  - - C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
      .\bin\gldriverquery64.exe
      4⤵
      Executes dropped EXE
      PID:3032
  - - C:\Program Files (x86)\Steam\bin\gldriverquery.exe
      .\bin\gldriverquery.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:15872
  - - C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
      .\bin\vulkandriverquery64.exe
      4⤵
      Executes dropped EXE
      PID:15896
  - - C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
      .\bin\vulkandriverquery.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:16196

C:\Program Files (x86)\Common Files\Steam\steamservice.exe
"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:16164
- C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe
  "C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe" /Update
  2⤵
  - Executes dropped EXE
  PID:4404

C:\Program Files (x86)\Common Files\Steam\steamservice.exe
"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:724

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E4 0x00000000000004E8
1⤵
PID:2608

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:19512

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6588

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:7240

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}
1⤵
PID:10868

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:10840

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:19084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff866b0c728,0x7ff866b0c734,0x7ff866b0c740
  2⤵
  PID:19136
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1560,i,2105136619655707722,2881323318207050516,262144 --field-trial-handle=1884,i,11278633327670617366,3001204791694673281,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=1880 /prefetch:2
  2⤵
  PID:19148
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2208,i,6778025090392650558,16826696242785758420,524288 --field-trial-handle=1884,i,11278633327670617366,3001204791694673281,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=2216 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:12656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,1015874170376527660,4090660052761924120,524288 --field-trial-handle=1884,i,11278633327670617366,3001204791694673281,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=2516 /prefetch:13
  2⤵
  PID:12728
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3200,i,4979623274083059655,3528832190810311413,2097152 --field-trial-handle=1884,i,11278633327670617366,3001204791694673281,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:13008
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3344,i,17310834524014637663,15959659556149617383,2097152 --field-trial-handle=1884,i,11278633327670617366,3001204791694673281,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:19132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4432,i,5536023648391587201,10021983019147692501,2097152 --field-trial-handle=1884,i,11278633327670617366,3001204791694673281,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:14508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5276,i,16910465787523257455,15841466129879145141,524288 --field-trial-handle=1884,i,11278633327670617366,3001204791694673281,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:14252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5516,i,16314020389513606889,1925863690565020668,2097152 --field-trial-handle=1884,i,11278633327670617366,3001204791694673281,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:14064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4380,i,14153055268412332674,2456643673712701766,2097152 --field-trial-handle=1884,i,11278633327670617366,3001204791694673281,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:13840
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3412,i,10701426950617717997,9106826456065377616,2097152 --field-trial-handle=1884,i,11278633327670617366,3001204791694673281,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:6276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,2196061811835701849,5091525247716345259,524288 --field-trial-handle=1884,i,11278633327670617366,3001204791694673281,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=6024 /prefetch:14
  2⤵
  PID:13232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4692,i,3669395566616254203,9344504507685205069,524288 --field-trial-handle=1884,i,11278633327670617366,3001204791694673281,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=6012 /prefetch:14
  2⤵
  PID:13224
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5896,i,7070135714294292936,13086222196318065312,524288 --field-trial-handle=1884,i,11278633327670617366,3001204791694673281,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:13212
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --metrics-shmem-handle=6032,i,7698135486559668918,18183595695284079858,524288 --field-trial-handle=1884,i,11278633327670617366,3001204791694673281,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=6012 /prefetch:14
  2⤵
  PID:1000
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6084,i,8327683047636081129,13118297785275578592,524288 --field-trial-handle=1884,i,11278633327670617366,3001204791694673281,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - NTFS ADS
  PID:5108
- C:\Users\Admin\Downloads\st-setup-1.8.30.exe
  "C:\Users\Admin\Downloads\st-setup-1.8.30.exe"
  2⤵
  - Executes dropped EXE
  PID:12136
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Program Files\SteamTools" /grant:r "*S-1-5-32-545:(OI)(CI)F" /T
    3⤵
    - Modifies file permissions
    PID:11920
- - C:\Windows\SYSTEM32\icacls.exe
    icacls "C:\Program Files\SteamTools\*.*" /grant:r "*S-1-5-32-545:(OI)(CI)F"
    3⤵
    - Modifies file permissions
    PID:11864
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe" "C:\Program Files\SteamTools\SteamTools.exe"
    3⤵
    PID:11720

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:22984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:14136

C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\wt.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\wt.exe"
1⤵
PID:11712
- C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\WindowsTerminal.exe
  wt.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:11644
- - C:\Windows\system32\wsl.exe
    C:\Windows\system32\wsl.exe --list
    3⤵
    PID:22396
- - C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe
    "C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\OpenConsole.exe" --headless --win32input --resizeQuirk --width 120 --height 27 --signal 0xa14 --server 0xa10
    3⤵
    PID:13508
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - Badlisted process makes network request
    - Suspicious behavior: EnumeratesProcesses
    PID:13500

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:11640
- C:\Program Files\SteamTools\SteamTools.exe
  "C:\Program Files\SteamTools\SteamTools.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:11608
- - C:\program files (x86)\steam\steam.exe
    "C:\program files (x86)\steam\steam.exe"
    3⤵
    - Executes dropped EXE
    PID:8476
- - C:\program files (x86)\steam\steam.exe
    "C:\program files (x86)\steam\steam.exe"
    3⤵
    - Executes dropped EXE
    PID:8524
- - C:\program files (x86)\steam\steam.exe
    "C:\program files (x86)\steam\steam.exe"
    3⤵
    - Executes dropped EXE
    - Checks SCSI registry key(s)
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:8536
  - - C:\program files (x86)\steam\steamsysinfo.exe
      "C:\program files (x86)\steam\steamsysinfo.exe" -steamid 0 -buildid 1782866176 -logdir "C:\program files (x86)\steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\3A33.tmp
      4⤵
      Executes dropped EXE
      PID:1988
  - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
      "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=8536" "-buildid=1782866176" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\program files (x86)\steam\clientui" "-steampath=C:\program files (x86)\steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Enumerates system info in registry
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SendNotifyMessage
      PID:21524
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\program files (x86)\steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1782866176 --initial-client-data=0x298,0x29c,0x2a0,0x294,0x2a4,0x7ff8566baea0,0x7ff8566baeac,0x7ff8566baeb8
        5⤵
        Executes dropped EXE
        
        PID:21552
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1848,i,11014546458014128637,13089050666730369343,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1852 --mojo-platform-channel-handle=1840 /prefetch:2
        5⤵
        Executes dropped EXE
        
        PID:21052
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --field-trial-handle=2156,i,11014546458014128637,13089050666730369343,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2176 --mojo-platform-channel-handle=2172 /prefetch:11
        5⤵
        Executes dropped EXE
        System Time Discovery
        
        PID:21788
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --field-trial-handle=2264,i,11014546458014128637,13089050666730369343,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2412 --mojo-platform-channel-handle=2416 /prefetch:13
        5⤵
        Executes dropped EXE
        
        PID:21868
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3860,i,11014546458014128637,13089050666730369343,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=3920 --mojo-platform-channel-handle=3916 /prefetch:1
        5⤵
        Executes dropped EXE
        
        PID:7108
    - - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
        
        "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1782866176 --steamid=0 --field-trial-handle=4600,i,11014546458014128637,13089050666730369343,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4520 --mojo-platform-channel-handle=4380 /prefetch:14
        5⤵
        Executes dropped EXE
        
        PID:18752
  - - C:\program files (x86)\steam\bin\gldriverquery64.exe
      .\bin\gldriverquery64.exe
      4⤵
      Executes dropped EXE
      PID:7068
  - - C:\program files (x86)\steam\bin\gldriverquery.exe
      .\bin\gldriverquery.exe
      4⤵
      Executes dropped EXE
      PID:7668
  - - C:\program files (x86)\steam\bin\vulkandriverquery64.exe
      .\bin\vulkandriverquery64.exe
      4⤵
      Executes dropped EXE
      PID:7692
  - - C:\program files (x86)\steam\bin\vulkandriverquery.exe
      .\bin\vulkandriverquery.exe
      4⤵
      Executes dropped EXE
      PID:7812

C:\Program Files (x86)\Common Files\Steam\steamservice.exe
"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:21664

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of SendNotifyMessage
PID:18456
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff866b0c728,0x7ff866b0c734,0x7ff866b0c740
  2⤵
  PID:18448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1624,i,7893434849204994029,6680980639132700690,262144 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:18088
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1796,i,6603929079861159020,5125043978930145004,524288 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=2084 /prefetch:11
  2⤵
  - System Time Discovery
  PID:18072
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,6543817986562162161,14341814842562602115,524288 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=2360 /prefetch:13
  2⤵
  PID:18028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,2154913071377222800,16246212708191058344,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:17892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3308,i,12440888666645336639,4195136153091424065,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:17872
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4504,i,18378004938642428439,5022998929825663977,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:17680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5356,i,14704060375162306833,9618507848400710199,524288 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:17524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5396,i,13415440110781984377,9431546129389855609,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:17324
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5608,i,2388503586827365921,13385251540597582096,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:10752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=3300,i,13295040668474395984,14946596438495263484,524288 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=3548 /prefetch:12
  2⤵
  PID:10632
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3440,i,17753017724621236142,4411306467943536616,524288 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=3516 /prefetch:14
  2⤵
  - Modifies registry class
  PID:10636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5912,i,9502322590981524190,10190369371662634252,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:10296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5616,i,6800450798004539402,13961836007576616842,524288 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=3576 /prefetch:14
  2⤵
  PID:10048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5392,i,12096304799570201938,13297896072976860336,524288 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=5664 /prefetch:14
  2⤵
  PID:10032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3552,i,1556509590871232625,16382599985797782563,524288 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:10012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5500,i,2231474387349772233,5035462419636156466,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:9404
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=3576,i,9384083386606644969,15107118039706135188,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:9256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=3572,i,5872106683822061458,16170973528988038370,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:9260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=5624,i,2978335677258078212,2072007744670419964,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:8848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5828,i,18122511071803512912,13899564886322169788,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=6520,i,7925063842399403817,12315293425867719556,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=6224,i,6643467637834280869,17297188302047381685,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=6160,i,15903444606641543994,6528677427725995314,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:16100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6932,i,2835202456779673240,14011595403468929371,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=6936,i,9764623117585589151,9398535416173227772,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:14816
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6188,i,14683705177825841715,1544357214998290886,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:14856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=7304,i,8495404724180447784,3662427320039741769,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:14964
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=6708,i,2884284107488630634,10040604817639475231,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=7400 /prefetch:1
  2⤵
  PID:15064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=7124,i,150057339967189769,17867300286605715340,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:15120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=6968,i,13085306367874816167,14998183009508641833,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:15128
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=6580,i,6171974132512938737,16538997209270457581,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:11092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7180,i,17948560346338209665,759770076173037405,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:16592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=5280,i,4972567924886318888,11174029501937798754,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:16848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=6044,i,6059276258493497302,12917836464543825355,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=7304 /prefetch:1
  2⤵
  PID:16944
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=6776,i,11567138454717872308,15415304862077017004,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:20056
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=6600,i,3484518733677758430,8308021635817637610,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:20444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=6760,i,11168640200237439783,199831024330176209,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:20620
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=7116,i,7107109605283060852,3018197362431509497,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=7252 /prefetch:1
  2⤵
  PID:20564
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=7584,i,15070550367350040835,16059172428525922975,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:20844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=7400,i,550239246495388741,11795353651757232846,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=7188 /prefetch:1
  2⤵
  PID:20896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=6172,i,161254869044348595,9303200442462970201,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=7096 /prefetch:1
  2⤵
  PID:6808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=7076,i,704040061125257541,13668625389329118274,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=7192 /prefetch:1
  2⤵
  PID:6824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=7656,i,9931859826372269149,15508711605777526373,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=7368 /prefetch:1
  2⤵
  PID:12444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=7164,i,14815326234152533695,17251727041275125603,2097152 --field-trial-handle=2028,i,12974562058713691818,8704693064697613573,262144 --variations-seed-version=20260712-030030.562000-production --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:12516

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:17788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SteamService.dll

Path C:\Program Files (x86)\Common Files\Steam\SteamService.dll
Size 3.6MB
SHA256 6e8870c59fc89908fc64e25560d306ce3d6d3e420212a9a29b488d120d18f100
MD5 dca45388a84911af7186689fd225c6dc
SHA1 e57539fcd9f8fc59ad94ee0efb1ab35e914cb063
SHA512 2df1998ef66a5c7559462791950ef6c7ac0cb0a718ed0b9a754dc8d20318115edb093027de6b1597410f71ae77432cdab08f9660080df8a258b5a465c07e8222
SSDEEP 49152:YWpaIr8KjH/rGXfyjTdb+P9j76FGS20I7cSRL0+S096tPx3BVw9eJRTOxDQvpD7:YWpXnjH/sfydb+Vj7eGUIYW0+R6T3Bn
TLSH
T19206BF12FA42C172E49E02B5646F9B7E9D7DAA204739C4C3A7D42D699C301E33B3B356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamServiceTmp.exe

Path C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe
Size 2.8MB
SHA256 26181987d137f76c514616a1ac52e806fc474f6afbeb0c10b2d33c939205bf92
MD5 09574ac126b2550098533af1d685aada
SHA1 3e4822c438bfb7a01d148a9b8fdeefb98c3093da
SHA512 49b8a220497cd26d999d48238313f0a2daddaac2f9756093182f51841003a10ffc0678e29895ed3a21149afb209eb2d0cf92c44b36a33e9fe10ec9e261bae6ad
SSDEEP 49152:e2v9HjNZZIpT1EQkGok4PetYsXqDWtrOtPLGH1GJ5DmWV9SCbJB5AQMW:e2vFBIpT0GX4WtKDW49GHEHmi
TLSH
T16FD5AE12FA4189B9E9D31174E2EF577A4A396F20033588C797D03FA958325D2BB3E385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cpuidsdk.dll

Path C:\Program Files (x86)\Common Files\Steam\cpuidsdk.dll
Size 3.4MB
SHA256 2c74ce7eae980c664760f0b0cf5e9852de9823e8a7b9dcdb4f6c30a5015755e8
MD5 a09978377657626e40cedea136bdb304
SHA1 a6c851a1c6c2a7158c8d9d17391904b56e954ad4
SHA512 593dc39fd2d3aba7bb8ae466a4362194c9df89abe0e3f49434b344aee738584fde4f3e6d21d239fc4bf7b86de167f8d7f2c9cd41c218be34397179910acb0fe6
SSDEEP 49152:hbK+rkFjWRrHH4PKjis2FSnT96gccjvQ/WnGvi4KS/g:l1kFXPKms2QnZ3KviN
TLSH
T131F56B51B3C89CF1D0AA0A3103ABAF194F79B7549B3886EF56D45D8D2D319C0BC3E25A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

crashhandler.dll

Path C:\Program Files (x86)\Common Files\Steam\crashhandler.dll
Size 400KB
SHA256 7cdc1d5d3c62f9e9639c82448e654bbb1b82e7d0d249b049c6b3714b28cbd1a0
MD5 8ea6e69b5749efc3284728dc25446d47
SHA1 326965e829acd872717a088b28233aefa6e64ff8
SHA512 0ce1a1454a407bc6a426f4eaa0b9f9838759b46c798aaa1d83ac10e0c579d7a233dab01cb2fcccd1af6a9fd2a9fbf4d48a7437073452ec5d40d52ba0754cf479
SSDEEP 6144:nrDdiG8LpFvEx/aMhnFujdYgD3X7lLM1lMRLyd6wB78mmkJAOfGZW08:rDdiG8LvvSpFujdYgDHcMRLJkJNGZw
TLSH
T106949E11F892C073D57E18306979EF6A5A3DB8601F68A4EBE3C40DEB4E706C1973971A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

drivers.exe

Path C:\Program Files (x86)\Common Files\Steam\drivers.exe
Size 7.1MB
SHA256 06099ff2cd3c07315e1d47d1e6c1bb7caa6166c079af2265674f0dce3a2e8294
MD5 82b8c286771eed8a5fc8ca83028fa8e9
SHA1 84dda52b191f6acd70339d955e1edaab30ae1eab
SHA512 cf4f6dbd6f53fbef4c5e26569117f1dd38c15e947aeaa2cafc9b2bf2b11a2d9afb83caa3a3804d405b9b1b8d3c3da9d5f5d291a18942b0114ff5abebec9ce0fa
SSDEEP 196608:RNmxPFWJgzW11PDQhACcuFWJgzW11Pko+NbhACcX5:RNmKJeM1PDQhApJeM1PubhAp
TLSH
T16C7623657A050EBCEBF1B674EBDD532513A81D9502BB98CF13D03F893937D82B99A081
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

secure_desktop_capture.exe

Path C:\Program Files (x86)\Common Files\Steam\secure_desktop_capture.exe
Size 3.7MB
SHA256 666f294fa46fcd92c5fb4e391011705104082b9da2e011437d501b36e75a5e33
MD5 29bdf5e43b63bfef6440faaef8eedc43
SHA1 b40be088c522b7fd1a9eeb3c7066d880562bbb18
SHA512 361ff2609e5a247d62ff17a840bc95946d7ea18c48d5c4347bbfa27f31a4f2791a127890994f0c2a043b218e30db311b0851f0c7c4fe5b78d5d977ac14231125
SSDEEP 49152:PGtlq1aVwASOz5IU6iyaWkSyrZ12B+fti1oYvJWYWQaIhfCj89zd6Hekt6Tql8Bc:6++DHz1i1oYJvJC8ZGVhkbYmC
TLSH
T1D2067C16665901FCD5B7D138C6CA5627E7B17C0603B18BCB02E4BA661F33AE26E3E741
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

service_default_Public_versions.vdf

Path C:\Program Files (x86)\Common Files\Steam\service_default_Public_versions.vdf
Size 808B
SHA256 6f9f3db4f4b8a98d921ffcb7414b2adae32f3803e592c06b9c7ec16b344e009a
MD5 099d293e4332f378d53075437e395662
SHA1 dda8ca4dff68e3d1469115540dd120a094e0f529
SHA512 6f7c076a139df168eb05c9a978ca225ec42f2b7cad5525e51be14997c104be205af1d33cae8eb8307c82ce25e933953e5aaacc8935353cbd8986a0b79e3625ff
TLSH
T1AA01491FD183FCFB45640B6A5B8B98F6472E149BACC76C433D41105D91F9838651561D
MD5 SHA1 SHA512 TLSH

Submit Download

service_minimum_versions.vdf

Path C:\Program Files (x86)\Common Files\Steam\service_minimum_versions.vdf
Size 727B
SHA256 a75ecb06d45017d2289ec27dac9f418c6ef82a9352e012670a0c67161c25c52c
MD5 47ea8d10c7c8e5ab9259a6b164a9e2d3
SHA1 cdaedb2b5d5b937930eef504de997592e95f487d
SHA512 8b85dffebf9e21e436d48292fb3bce54e01b1470bc1fc7dabbee2233743c7025cd7c59523ffa1d0f1ca50d2b1edf7bb18787aa4df61d7dfec155323ae0eb1ccf
TLSH
T1DA01DC1FBCC2A8BA2BB2465B8BF78CCE6F780906549A3CC05D840C4893E8E1C1709045
MD5 SHA1 SHA512 TLSH

Submit Download

steamerrorreporter.exe

Path C:\Program Files (x86)\Common Files\Steam\steamerrorreporter.exe
Size 691KB
SHA256 ae57dd7b7f3c140625533df0bd614dfc4c8408d91db652ac4cba45daf72741a6
MD5 adb12c3aae35e268507946c3ec6f6873
SHA1 73b1b3dc13bd6214025aca508491f5d58eba0108
SHA512 5641f252771fa07ade23a02855af6ba35c8ba23c32536210edff09542b7343d876be18768d88c4efd8cd9e185c5cbd85c74945b096c5e98c4eb0719d822c2664
SSDEEP 12288:fX+v2auF7fLXh1oyx3UG8Nwghm5oprCdo:fX+87Toc3UG7ghmSwdo
TLSH
T1C9E429607901497DEBF07A34EBED937513A92D51073758CF23D03F8A3932AC2AA7A156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steamxboxutil64.exe

Path C:\Program Files (x86)\Common Files\Steam\steamxboxutil64.exe
Size 751KB
SHA256 82b1da408da1be33da6893f66ff8156cc6923cb5c7f7aa2cc988f6dae414b882
MD5 eb973e607fc9868b96ee036ba8fe83dd
SHA1 507d2c2267e23a987ff99d2c7bffc1ee268fd189
SHA512 c5fc4901e289b7c23f1c9c998885ed9ead63160c336e5c75c9ed40987f38ba9294643c79ab6b095a3ef04759c5d4201e0481eb7d7753fe0a8627a49201c7ee53
SSDEEP 6144:CLL0z+/CS76mOUvTcU0KQAfngWLPhyJyJYqLu0s4Mq4QJWuLbvER0u+GIIIIIIIx:CLL0zqCS76STcK7dtJk0sN5AAm5j
TLSH
T142F4296466050AFCEAF1B638DBCE5211D3B13D52023795CF13D47F8A3E33A52AE6A251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Steam.exe

Path C:\Program Files (x86)\Steam\Steam.exe
Size 4.2MB
SHA256 12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1
MD5 33bcb1c8975a4063a134a72803e0ca16
SHA1 ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65
SHA512 13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49
SSDEEP 98304:7JeV/ztZBe91oiImuUiK9N9EGQKF9lSHbr7aw:1S/hwkmg4EpbrOw
TLSH
T1C516BF62BB41C071F9C201B964BE9F7A497DAE204775C0D397D43E6A88311D32B3A79B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamService.exe

Path C:\Program Files (x86)\Steam\bin\SteamService.exe
Size 2.5MB
SHA256 ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d
MD5 ba0ea9249da4ab8f62432617489ae5a6
SHA1 d8873c5dcb6e128c39cf0c423b502821343659a7
SHA512 52958d55b03e1ddc69afc2f1a02f7813199e4b3bf114514c438ab4d10d5ca83b865ba6090550951c0a43b666c6728304009572212444a27a3f5184663f4b0b8b
SSDEEP 49152:G+v+Y6iR3Gdcw/9I4AEZvvxYtP6iJ6aFmDJRicyM/wHH1sc:G+v+YbGiwV9AEZvW0iJRma
TLSH
T14FC5AE12FA4248BDE9D21578E2EF537B4A396E101335C8C787D03F5568326D2BA3E399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.vdf

Path C:\Program Files (x86)\Steam\config\config.vdf
Size 19KB
SHA256 a0f6254ac291d9d116fd8746e8d53cd7b601e5937bf7909a778216c380063a31
MD5 716dd05ea7e17f442aba83d093061d95
SHA1 6137fcb2ecd5e4998fa5a9221971c951ec758803
SHA512 33260b08746db596d559bda1f2cda86e69b68c61751406c4dc7c1596f683c64c9bd10b0cbc571580b71986fa191b75068be0c0c39e5ac08388ef7a3cd6593af5
SSDEEP 96:Pl90q1fu6uBblvHDzzn6NMUCYPMUCY+njVrr:99v1MBpvjzzn6vt6
TLSH
T13392394B693C80AF13555A6D12E6A0DE169C427F6A98D1F3B7E21A1B7108F1DB1FC338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.vdf

Path C:\Program Files (x86)\Steam\config\config.vdf
Size 14KB
SHA256 eb05e747231ddb5bd993e40de4efcfb657fc00bd9aa82a8eacc98a5d99f852b3
MD5 4484a2eecbaef5b81b6d53c2fbd5af42
SHA1 db8694c8288b0ead57c2d2e0db0fd704ab29a4f1
SHA512 1df2d3b1b0a992534ec6061b477d7add5bd8097f63d720062711689bcefbd2025d13cc29676e2ff80a75dab8375d7bc768ef6dc8a14a45147bd09e4da68a40aa
SSDEEP 96:Pl9bmCSaTALiXGEbmB9sMUCYPMUC/njVrr:99bDtALiXGE5Y
TLSH
T1FE525E476D2C40AF13589E6D12E6A0DE129C427F6A9891F3B7E25B0B6108F1DB5BC338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.vdf

Path C:\Program Files (x86)\Steam\config\config.vdf
Size 19KB
SHA256 4b29ff38a47a7988b50c7a98d23f4fa7bc589c7a739e1a07584e1ca0c6885782
MD5 fea8876a33478d8a3e91b2b1dbfdaf45
SHA1 78210655a4fa3c11ad84b8e27231cec6f7d16289
SHA512 7324c0cf6e85259534c176d198fdbde284ed3d891d16956068e97cb7ae01d272d42d02bd76f4fc8fc749c2f80fa7ab4fea9f665463b6e4a002e97f1874e16020
SSDEEP 96:Pl9+8JhASBorAOL/myOqMUCYPMUCY+njVrr:99ZJh1orrL/myO4t6
TLSH
T10792494B693D80AF03555A6D12E6A0DE169C427F6A98D1F3B7E21A1B7108F1DB1FC338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.vdf

Path C:\Program Files (x86)\Steam\config\config.vdf
Size 20KB
SHA256 3a0249ffb47c62999c8ead29d718a3c133ae7308f9bcd0dd25f2c6e1ae246b8c
MD5 0df20fcc134bca481180d42c3ec5b41d
SHA1 8f0e76044b342c69c576c979d361796bbcc3a80c
SHA512 d445b7749c1ac2804af31c29a725dce290bce31a0d3bf6cba318b440ac5c62ba28f5f23a94bdd76f7e305d29ace7a22b3fe8fc6effeb41496ee7d4e5b2aba233
SSDEEP 96:Pl9UROZLxD5hiDcy1Q7/MUCYPMUC/njVrr:99UkZLxziDcy1Q7dY
TLSH
T19792384B693C80AF13555A6D12E6A0DE169C427F6A98D1F3B7E21A1B7108F1DB1FC338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.vdf

Path C:\Program Files (x86)\Steam\config\config.vdf
Size 1KB
SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
MD5 a2ec2e91c3ef8c42e22c4887d032b333
SHA1 e2c738a2e9400535b74e2263c7e7d1ecefe575f2
SHA512 b069d241efb19e09ec8b5e60ef6c43e00d5cc0f774b9340127c2180356dd1964ac625c1afdfaee5f99e72b26f56046fc329aadbbc365b403af765a55e9c9aab3
TLSH
T1A121002E2BBB491FCE0E0C7BC18FB9A0543FB15C39C314C4BEA4489E7D20E11506DA14
MD5 SHA1 SHA512 TLSH

Submit Download

config.vdf

Path C:\Program Files (x86)\Steam\config\config.vdf
Size 9KB
SHA256 9f34362c84c9d3df252693cc5fe3c1f775f8417b0b281dd32f3eff0a181492db
MD5 9f8a0210d9010438f33033e7bbec1bcf
SHA1 7b64685c3ca76c9a8cf545f507e0e2f5194b5191
SHA512 baeb5cb429bee6b0f848d10111ca39b6c3550f64cd2ff5c3338709e929348391db642a83bd7af826d835c4beb9364bf2abbb97afa63319814649b78cf883a8c7
SSDEEP 48:Pl9XNM/WUzz3WUzztUzUUJilAlHw3WqCFqQl3Qopw0zEuo5wN3TwVnwh34DwhVLh:Pl97MmMtk8GHPuc3yTMUCYPMUC/njVrr
TLSH
T1D5225D476D2D809F03598E6D12E6A0DE129C527F6A9891F3F7E25A0B7108F1DB5BC338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.vdf~RFe5c4b49.TMP

Path C:\Program Files (x86)\Steam\config\config.vdf~RFe5c4b49.TMP
Size 1KB
SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
MD5 6e6a2b18264504cc084caa3ad0bfc6ae
SHA1 b177d719bd3c1bc547d5c97937a584b8b7d57196
SHA512 74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679
TLSH
T1FA119E5C6BB7490FCF1E0877C28FB955582FB08D79C354D8BFA448997E10E22106ED15
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Program Files (x86)\Steam\dumps\settings.dat
Size 56B
SHA256 f16dccd098a5a6ce02224dbf0be6b6da52d0156c8ac0af181152ebf65ceb5821
MD5 16fc0da2f4c4bfd82430ba73d0becc6a
SHA1 c4bab72e49aded1696d026b8a9cc732e8410178a
SHA512 2700ce398a22726d097c02ce4e47916e9428bf501251d861f6e6f731e9766a586ae1bf89bebce2902bd95ca232798b117508948201492d1754b1265f9bc11cdd
MD5 SHA1 SHA512

Submit Download

bootstrap_log.txt

Path C:\Program Files (x86)\Steam\logs\bootstrap_log.txt
Size 17KB
SHA256 74bb27b816be111c059b425045fa1d4157b51791c80097013b052432b7501758
MD5 7d62c5eacd1d2633814a9eed76592a19
SHA1 8af19e29665174a25fd8e394fc12daa679f891b7
SHA512 0695154f982f26993c206300d43a48067d8fc169daa955d27a902179724ef9ef9361aeafe5da0ea5f0fd4ba16b7d4dcbc0d5d3da84db31afdc9fa8495768f0a7
SSDEEP 384:hwWaechJ4FBcQ57WQwUQ0CfgAenVRd91Ku3aFocch/F94DM5YHX:h/aecvuBcQ579wUQ0CfgAenVRd9Qu3Yn
TLSH
T1F382285B367FD83E656002A9C85A1E56DC46B0031B653CCDF7D42D08B7A0D329EAF92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cef_log.txt

Path C:\Program Files (x86)\Steam\logs\cef_log.txt
Size 24KB
SHA256 c45adce77fd9d1647cc966aa8b3387375cb9db65a5efcea72704d8662e8ad4cf
MD5 b7fc077b666b49de647270960ef1824b
SHA1 c56ed812b594117fbd3f7b30c342fe0b8e93aa10
SHA512 456227705ff8e628d468e54da3b367329309c350ea7d54d4e95170d8a1241d7d46fde29416b767093c2bb91e9cd589b3108782f3f7f13ef3d505292eabeed8ec
SSDEEP 96:4qLlGLoLvYEYhPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPP3:4qLlAivYEYV
TLSH
T15CB2BF4F2EEA5D6420CB55F4F684F7550AD1161876BA31FCCE784C4D2621AD3A930B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_client_win32

Path C:\Program Files (x86)\Steam\package\steam_client_win32
Size 8KB
SHA256 cee78c3245b22e28deb3261a61d8041cbff110c8b3ac210ad74ffdb6aa5c1bc0
MD5 0856f688dd45e8ddcc5e29c944c13caa
SHA1 87fa7f5f12492f1bfe0fdf871a4085815d526b45
SHA512 01be71ffbd72aa727f071b9d903d9f8ac92ed1e037d4d5a49fce73d98a594091d6591efc5ff7cc112a10842c02da11d57075a0c5c3be1e7511cb09a342d5daea
SSDEEP 192:ZDPMpLQ1x8kH4z4tGUUBQZkJMEnIUFPoH4:ipLQH8g40BlwMEnIUFPB
TLSH
T16602A3A33A45B06426958B4B84305ED90FE8B64752BF2DEBCE2ECF1C98F2D4579E7004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

btnOvrOffBottom.tga_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\btnOvrOffBottom.tga_
Size 444B
SHA256 ecd13153d9d438809a38de30f3abbb0f6f92837a7e3cacb442a9a9309bcd78d9
MD5 89cb2bc5ccdab01b0653d4dbb3d6a062
SHA1 afb947fffd5f5f3723e0c8c3b52cb8cbff406ee9
SHA512 e5bef83bfad930e2b68720e00d450aa879619dcabcf8d96f9f8c47636a95a9662bc91b04cfa9160081d8af79a1257b75647d89677123f28b8c609808d5b86653
TLSH
T1CFF004040C400137C744757DDCD7C5CD77D4F4301540014C57D0307504D5041D1F44D0
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
Size 6KB
SHA256 5afc5816946e0d7b6d57a99a60be71d9e88670d9a63c18e249c9266d8e95cd2f
MD5 5a5715177822e69c98aab578421ae78f
SHA1 175ea27d6ef6df27fae93a724c94b2c770f78205
SHA512 b11d05dff7f9ce55c2b30de82709f5aa9b410734e1b88a6879e3489394a5b36a27389022de0a741a16f70d0639439d4f75942c3fd604567d63b9ec229d86b331
SSDEEP 48:dfnnnW6kQhYvc072yybS7WWjsHannnffw:Xr
TLSH
T161E12E6C226CC9DA805BB8F0CA19CBF804060EC9E85E11DFA0D73E8CFE38C8AE431500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloud_localfiles.tga_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\cloud_localfiles.tga_
Size 14KB
SHA256 c7a1b0021d1f943e497c592d83050ac85a3b93aff732f9b94cd26d9c41b37ca3
MD5 c4e538289a4c12da96cec77e7a3e36d8
SHA1 12d57144c0e79edbabc8033a9bf22b1720299f2f
SHA512 db3eac8c05b7277a6ab9974c682b20350705fcf616040204bab053d98cf193c2d6fc416eb571ca67f7e53bda59ccaddc0351bf60310a64dba2d83fd9aa539ab1
SSDEEP 384:1MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMrMMMMMMMMMMMMMMMMMMMMMMMMMMMMM0MY:ABTA
TLSH
T157626B16A05E37CE310A055AD1256DA3FA2021F58355346F30FBDE1668702B71AEEFAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
Size 15KB
SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
MD5 577b7286c7b05cecde9bea0a0d39740e
SHA1 144d97afe83738177a2dbe43994f14ec11e44b53
SHA512 8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0
SSDEEP 192:JDApAAAAAAAAAAAAGPAAAAAAAAAAAAK5Oq:JDAfIq
TLSH
T1D5623E04FC24B31BD6B9E07EAA974B0B507F4CD9D84330D40C7A5CA8B98DB02A26643F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
Size 92KB
SHA256 e0ce36b93ae67846424364085ad79ee24fe5c036e5f6a78a4acbe1583f22daab
MD5 323181f4e9013b8b341897abd322e56c
SHA1 85e2e4a5d38c515185415bd4aa8d24f32d428fa2
SHA512 24fc5c82e25f2ee689b0888c6905f13ae74037e8db06a39b247d525071c858e8a284600dc5e33f006a2657d04c0b045c146c2af0951c7ecdceec34082a95d004
SSDEEP 192:JjJzVPBVK2A54RrjK/MQqLVWT5qOuIToER2zrpIEl:Jd5FjKkQqLVWT5qOu+tR2znl
TLSH
T1719359726F6CFC49BC94C88EE14132D065725AE7804B2551F8B4EE30E1E7ED72E9A94C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_button_news_mousedown.tga_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_
Size 20KB
SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
MD5 00bf35778a90f9dfa68ce0d1a032d9b5
SHA1 de6a3d102de9a186e1585be14b49390dcb9605d6
SHA512 342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041
SSDEEP 48:X77qTxcazfhjZRRRRRRRRRRRRRRRRRRRKFvJJJhmAr:X774zmvJJJhmu
TLSH
T18F9209380E706CCE81CE9A27AB348AD2A9D2DC6F36632E348653350FC1948543EA734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tabStdBottom.tga_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\tabStdBottom.tga_
Size 48B
SHA256 5caa5fa3e79dcd8ec5ec20256ed7c77efaae77e0ae8d89e4a974c484cb177d84
MD5 bd64c051ae2410eef96839a3cb7297f7
SHA1 95a5b0455d69127fe50e396153c795d9914ce0d4
SHA512 ea2f76c8cf5dc2fd15017ad9b942d020c3ad5ce1cedc2a1604137ea02f8411cfff4166ffe93c101756b404344488b304cf2b4a71c25b2929654dda9a88a88793
MD5 SHA1 SHA512

Submit Download

steam_cloudsync.ico_

Path C:\Program Files (x86)\Steam\package\tmp\public\steam_cloudsync.ico_
Size 47KB
SHA256 5aaca90948de8f7d11264ed608a2f96acba061e6463d337d658b00ed1c552449
MD5 da277b7a17374bde018ffab02015238b
SHA1 ceaafa1a1ed7d2101ad3c2884159364aacbf9dcd
SHA512 5a6e542ae9938f560d40348ceac663feaf889a6c990efdcfbea919531dbc34771fe2f0f366ab7adc15e998e5ed392d80dad78a8392f11b9c8fdf2c67f0431a53
SSDEEP 768:CHjkEJqa7vWVw70BCDiSfUpWy46032U/C0Tz+3TaZeYJqF3D7RTB6F0SBS6:CDlJdvIw72ILUsyi9/CQ+34eY4zBCph
TLSH
T19F237CBEA78A557DC9A0473840CAEA7C433A6EC5E0A7C2C751D07F5B5C35643BE0E1A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_cloudsync_posix.tga_

Path C:\Program Files (x86)\Steam\package\tmp\public\steam_cloudsync_posix.tga_
Size 64KB
SHA256 fd2abb8945c06a6b9c5444baf6ea523b52bf7a03a58b34ebe0a6a110630ed5f8
MD5 be3a210738638c4f33aa7e01cb475e26
SHA1 02276a10cd77cfd57e4c796c45d69d526f8420bd
SHA512 6a11640800df51a8d88ef4224acd39cbb051dcdd6239bee82575ca11772a6a52e40c6614af3ea61320d29b4f75fc9611f6182ad2a55d7284863fd38d89631feb
SSDEEP 1536:fQF+zt5w33333333333333333W3333333333333333333DkqbbbbbbCm/b77vBQT:d5bbbbbbCm/b77MquuamizaWraS2Dz7o
TLSH
T165535F64EB112ABC9EF1BF05A6EA967813165D42113BCCFA168D7F4231F3A319DC6D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_tray.tga_

Path C:\Program Files (x86)\Steam\package\tmp\public\steam_tray.tga_
Size 1KB
SHA256 f747d5fd27e74412be05bb376c0ff12fcebb7f39c158eaa89ab6a0a9d92ef3b6
MD5 7ecf5b072a3c49209af4710481dff5c9
SHA1 6b49560eb27b2d7cd169c066208d4fd3a4863f3b
SHA512 ec9ed9d824471655a48b48324a023a7231560810f6403f0ded04af35b51dde4dcd244bd4147570ac9c5cf0c841af33caaf8de7d60cf20f6fcbedbd1717d6d262
TLSH
T12D1163C2ACCD1788DB12C53807E6E6021C320C1608B66EC9B4277356097B43CAAF649B
MD5 SHA1 SHA512 TLSH

Submit Download

filter_clean_bulgarian.txt.gz_

Path C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_
Size 23B
SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
MD5 836dd6b25a8902af48cd52738b675e4b
SHA1 449347c06a872bedf311046bca8d316bfba3830b
SHA512 6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80
MD5 SHA1 SHA512

Submit Download

filter_clean_schinese.txt.gz_

Path C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_schinese.txt.gz_
Size 33B
SHA256 77f0055faba992867817c485930c5f60cf64e65c65b410128426dc35fd8d862b
MD5 dd542d7ca2128ef0e7c3411b5ab9e8d3
SHA1 0a98ce0efdb5fd75d3c697f06f3c084d5882dc49
SHA512 0d0c1801d0bdf69d2010b0e26ce0a156fa50baaa0370330bdcdb879cbd09a6146d7bc89de2d5ea6f3615123a60e1be87def44c07f92de24615974e3cae2cab85
MD5 SHA1 SHA512

Submit Download

game_details_header_green.tga_

Path C:\Program Files (x86)\Steam\package\tmp\steam\cached\game_details_header_green.tga_
Size 2.1MB
SHA256 a24832de8b80e206143170a899ab91e76e85685aed74963fe2f490344bbf6427
MD5 1ed17a7d11da47608f99d98a8d249e6f
SHA1 ea3d9e0de541be2a346e93e63286f0265ac302fc
SHA512 e423be766c3d615dee6f3ed8b0b7bb5735ec13617a93f6f5403a3e7c4c379b9ab87e9fd5f0c9fa9338f656e321488d0aba895ac9f77da413e27473b2218b9ac7
SSDEEP 49152:q3m8TZFdk4Sd9DM8CsBALhExgBrPzkpRkQhbCh6:fDM8o6xgBnkkH6
TLSH
T1EEA54B0FF4A936693DC1EB9E11B1F1F438EA07534182DA93BDD79B4960C2C84A741B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_brazilian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt
Size 4KB
SHA256 0fcd7ae491b467858f2a8745c5ecdd55451399778c2119517ee686d1f264b544
MD5 0340d1a0bbdb8f3017d2326f4e351e0a
SHA1 90d078e9f732794db5b0ffeb781a1f2ed2966139
SHA512 9d23e020875ed35825169a6542512ec2ffdb349472a12eb1e59ddc635e57c8fd65fa919873821e35c755aa7d027c9a62d3d0fa617340449d7b2c4cf8dd707e93
SSDEEP 96:3aArpYaRZ8hYzaAD25nDoVIPEPVIPErKOo8D85e:Gar8iRCNDVPXP738D85e
TLSH
T1EEA113AF179911BC58BDC3ED370E4E9725CC6172662EA88895CECB0D0DE740772B3592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_bulgarian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt
Size 6KB
SHA256 76a6bd74194efd819d33802decdfddaae893069d7000e44944dda05022cfa6d9
MD5 4c81277a127e3d65fb5065f518ffe9c2
SHA1 253264b9b56e5bac0714d5be6cade09ae74c2a3a
SHA512 be077b61f3b6d56a1f4d24957deaf18d2dff699bda6569604aac4f1edb57c3cfd0abc5e2a67809f72e31a90b4aed0813536c153886da2099376964c60e56001a
SSDEEP 192:sKVp+typPx7rYLxGnyVqY8WYw6i0KfBKKfg38m8i/:sKVpiqMLxGnyVq/YEWYWg38m8G
TLSH
T1CED18C59076964DE4631F05EA9047E4B3DCA90FF3BB38B0501E9697C3EE307572BA289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_czech.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt
Size 4KB
SHA256 650a265dffdc5dc50200bb82d56f416a3a423eecc08c962cfd1ba2d40a1ff3f7
MD5 2158881817b9163bf0fd4724d549aed4
SHA1 c500f2e8f47a11129114ee4f19524aee8fecc502
SHA512 f3594aad9d6c50254f690c903f078a5b7a58c33bd418abdad711ebb74cfbdb5564679593e08fb2d4378faaf4160d45e3d276ba1aa8a174ed77a5791bcac46f28
SSDEEP 96:20Az7xzQK8VzRZfVAxzPXRQjpqp/lSPxIjfiI7yOo8S8qQk:/Az9zozrdAZPXR6qOPOvO38S8qQk
TLSH
T127A1351D035654B899BCC26C722C45B326CC9273A76338996ACEC76C4FA714BB3B7550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_danish.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt
Size 4KB
SHA256 fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115
MD5 03b664bd98485425c21cdf83bc358703
SHA1 0a31dcfeb1957e0b00b87c2305400d004a9a5bdb
SHA512 4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d
SSDEEP 96:iKSCj4RjGEcH6RZY77p7zrOsLEPnvIBXKvI2BqOo8380Bg3:BJj4jGnH6rY77lrOxPnQoQmq38380By
TLSH
T190910C4E5B79A1BCC8BCC6ACB22E05A3559CA13BE2322C4911CDC32D1F9785773BB152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_dutch.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt
Size 4KB
SHA256 56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192
MD5 31a29061e51e245f74bb26d103c666ad
SHA1 271e26240db3ba0dcffc10866ccfcfa1c33cf1cc
SHA512 f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8
SSDEEP 96:TnsaIWCk1TXfSRkAcXJNRZY/r/iza1GUNrzRxbM4x9yJs+Xc1AZqI79qIjiOo8nl:LsaIVATvycZNrY/KQyJs+ZZz79zji38l
TLSH
T17D91D15F136EA1FC89F8C2ACA90D42E7298DE2329227594C15DFC63D0E57417B2F61A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_english.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt
Size 4KB
SHA256 ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6
MD5 da6cd2483ad8a21e8356e63d036df55b
SHA1 0e808a400facec559e6fbab960a7bdfaab4c6b04
SHA512 06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925
SSDEEP 96:hSlb0IG997a8ICgARZ2pyUBnXPz5dc6LzIIivI/BxkHLs068:8lHmbICgAr2hJc6LkIiQ/DOLsV8
TLSH
T10F81BD6E072A71F185B1E57C760E0AD3998871BBA3221D5826DEC21C1F9711B63FB361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_finnish.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt
Size 4KB
SHA256 8ff0f3cbdf28102ff037b9cda90590e4b66e1e654b90f9aea2cd5364494d02b7
MD5 9e62fc923c65bfc3f40aaf6ec4fd1010
SHA1 8f76faff18bd64696683c2a7a04d16aac1ef7e61
SHA512 c8ff15373b37e848e6239a82424569e77c82a5fc557d17e7d2ed1d0d2b2f7d026cc1e2bc98cb5ee945c02cfefb82803c23fa6a26f48ff0adcf762f94cd5dd035
SSDEEP 96:OJCZC1RCSwhp1RZY/T4zcVYssvWIN71BIxZvaZIUZvaPOo8K8jbG:JkPwhp1rY/UcV0ALbYi38K8jK
TLSH
T133A1339E172AD1BCD0FCC5AC651840B759C8F9B7E6122C4493CA939D4DE345772B32B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_french.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt
Size 4KB
SHA256 a1f6ba57ee41e009d904905c0ce5e75a59ee6790e08542561303109e1faafa13
MD5 10c429eb58b4274af6b6ef08f376d46c
SHA1 af1e049ddb9f875c609b0f9a38651fc1867b50d3
SHA512 d8760f61760bffd8671b727d386ae220e7e6e68829a01553cfd5eb60ef8bd1d7c1b25e7b17a6db5bd17ba6712ef44999726764459318e784843c73bc4facaf46
SSDEEP 96:vk3l1CEN8RLcSMWPrfwgXWRZDbUvzBT5H5MEkJJIbcYIbsgqOo83fy8WJv:sVIEug0ETrDsB0EkQbclbsgq38Py8WJv
TLSH
T148A1F14E17FC32E965F8826E370516A35598F076F222B94859CA834C1F9B42773FB2A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_german.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt
Size 4KB
SHA256 0828572e4fa00c186dbf1d9072a6154d65cb499c6a37e338f3305f77a2fee382
MD5 5c026fd6072a7c5cf31c75818cddedec
SHA1 341aa1df1d034e6f0a7dff88d37c9f11a716cae6
SHA512 f9d28714b2a05f8d9025f1692e4d7e8baa6daf6176353f65646a38814a242ef2adededa44419edd69f10cf96ffba506dab7cb6e52111457bf69cffef12174b12
SSDEEP 96:hn6e0CBtWTkRBtWTkcBMBcVRZY13nSYzBPCN0ayRzkxjhoG8IJ8N8S3vIKa3DOoo:h6erBtWwBtWDBMBcVrYF7+3tZcQTD38P
TLSH
T1AEA1E06E077E61FDD5BED66C610985B3368CF227A313284C11CDC22D5E93477B2B9292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_greek.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt
Size 6KB
SHA256 c0a7a1df442ac080668762df795c72aa322e9d415c41bd0a4c676a4dc0551695
MD5 189ba063d1481528cbd6e0c4afc3abaa
SHA1 40bdd169fcc59928c69eea74fd7e057096b33092
SHA512 ce59ad9b17bab4de1254e92ce4fe7d8c8242832f62ab382e8f54199a9932cd11b5800cc33895441426373d5210cc74104e0271b721a7e26ed400b716ae4d5903
SSDEEP 192:xjAVmh67hMmrdtSIWdS0ZOfdS0ZQR38a8FN:gp8nOLQR38a8j
TLSH
T1DFD19ACF72697EBCD0A8D15E188812BB27C45D39A719C9C8225DC72C7EEA0237232957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_hungarian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt
Size 4KB
SHA256 1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5
MD5 18aaaf5ffcdd21b1b34291e812d83063
SHA1 aa9c7ae8d51e947582db493f0fd1d9941880429f
SHA512 4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154
SSDEEP 96:ADKraKKnH5BpRZELDO1cMQzQNW3kjN7MIOjHfvMIOwuOo888OK:W+a5BprELDXMAQNnN1OjHfhOwu3888OK
TLSH
T13BA11EAF033A70BDEDBDC16E36184293119EB127E22B2C7A22CED71C5E136177672156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_indonesian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_indonesian.txt
Size 4KB
SHA256 3b3c5c615fd82070cc951ab482d3de8cb12df0b3df59fbd11f9d3271fa2fbca4
MD5 1514d082b672b372cdfb8dd85c3437f1
SHA1 336a01192edb76ae6501d6974b3b6f0c05ea223a
SHA512 4d41c945ce7c94746875b0dbceb14811d4966de4e97fe047406a304162fde7e1e2a16367fc2e43978e2e5aa66749f036b4444aa2312673c2cc3af296e8b77f55
SSDEEP 96:avbCWRRc1yRZY+lDz+Xo2drTRw2IoMTb9ISQISXOo8V8El:o+2S1yrYWsEo0uWq38V8El
TLSH
T15F91B25E07AE70AD85BCC6FC660D06E31A4DE277A712394815CE8E7D0E9712733BB260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_italian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt
Size 4KB
SHA256 b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585
MD5 8958371646901eac40807eeb2f346382
SHA1 55fb07b48a3e354f7556d7edb75144635a850903
SHA512 14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554
SSDEEP 96:5fTYcpLQ4J+4XRZauvgpJ2zyHTNb9eMuIluIVOo83zy8Xa6:xpkA3XrDQHlHV38Dy8Xa6
TLSH
T162A100BE13AA60BCA8BDD26CA20951D7258CB4F77723354801CE971D1FC7513B6B21A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_japanese.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt
Size 5KB
SHA256 fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265
MD5 7e1d15fc9ba66a868c5c6cb1c2822f83
SHA1 bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7
SHA512 0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406
SSDEEP 96:wnwSwjaxKPVcljckFEJckFzRZYwCeHalzL9L3XHwrqdJOxoPLD1hKkHzULyqI5d5:ewSwINckeJck5rY5RXwaJdykHRly38TD
TLSH
T132B11F7C93AA24B98879C2BE290C56F36949AD27ED63392145DEC02C2E7360FF5315B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_koreana.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt
Size 4KB
SHA256 3d1399f5323a3ece1b1a8b3b31f8fd7f50c3bd319ab3f1c38c6e347452c95314
MD5 202b825d0ef72096b82db255c4e747fa
SHA1 3a3265e5bbaa1d1b774195a3858f29cea75c9e75
SHA512 e8fc7cc09f431301d22a07b238179ee053505090e3c4db30ead061513fe7159f1fe8b80efc93f4597fe00f01087bbe0bb2231e13693d72c8def138657cb91566
SSDEEP 96:bno0CtiVRtncgz5d4thtF5NdLRZYyzzjBaz23//w2Dv3RFQuVSMfXIjNXIPemiOO:zorkv+gteRFTtrYxUXLLBFQjOq3838gw
TLSH
T189A1E0DF1BA721E850F9C01C1B68A5A302C8B132FB23185CADC9DF5D8E6B05776B65B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_latam.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt
Size 4KB
SHA256 05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c
MD5 7913f3f33839e3af9e10455df69866c2
SHA1 15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25
SHA512 534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804
SSDEEP 96:9FDhCIRRcJ3NkrHRZYGerQrmermz+Ejp6lLSG+oIq2K/+oIq2vgKOo8348o06:fsISbSrYrybSZYlEzKazv938o8o06
TLSH
T1F9A1969E03DD26B89CF8C05E6A09C6A3628CE173B521B84412CEC31D1D9754BF373685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_norwegian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt
Size 4KB
SHA256 c084a68b65d507eb831831aa2ab9afb9536cb99a840d248cc155ff87fad18425
MD5 58e0fcbee3cca4ef61b97928cfe89535
SHA1 1297e3af3ca9e4fe3cc5db78ebbfa642e8a2c57b
SHA512 99aff0c481e34cd0e4fcbb2af471afb56d91aa11be664462b08e17ae169ca03ef77e7063b4ecd0f38ca7b2f6dc0bf2e316c7b31dffbbcfc763cd8fae27dc78d2
SSDEEP 96:hL+9CbrRtcejaRZYBEpdzQdbRAoWxqJcz6lIb2oZIA+Oo8q80Br+:EQb1+ejarYO7Qpsecz6Sb2o2A+38q80w
TLSH
T1FF910D4E4779B1FEDA78C6AC722E06FB419CB13BD2222D4901CEC21E0E9755772BA152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_polish.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt
Size 4KB
SHA256 0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32
MD5 9b0b0e82f753cc115d87c7199885ad1b
SHA1 5743a4ab58684c1f154f84895d87f000b4e98021
SHA512 b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df
SSDEEP 96:Wa2CgROcEhwYRZYXvs9zp6SjluImGIljIjXOo89p8FR:X1wVEhwYrYQoI4fOD3838FR
TLSH
T17B91129D036E61F8DAB8C1AD6A680AD315CDF07AEA27194812CF860D4F5301773F76A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_portuguese.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt
Size 4KB
SHA256 2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04
MD5 eb8926608c5933f05a3f0090e551b15d
SHA1 a1012904d440c0e74dad336eac8793ac110f78f8
SHA512 9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a
SSDEEP 96:uIsrct89cRZetJ2Ommrzrrd2GQvqGVA9VM7KOo8388UL6:Lt89crMYOZXwSwIx38s8UL6
TLSH
T18B91225E03AD1178897DC3AD770D5A9735CCA272B93A288817CE8B0E1E87417B3F3152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_romanian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt
Size 4KB
SHA256 f8d1972e75a320344e3c834ba0a3a6a86edb39e20ef706bda9b7965d440d1998
MD5 6367f43ea3780c4ee166454f5936b1a8
SHA1 027a2c24c8320458c49cd78053f586cb4d94ee6f
SHA512 31aab33e0d272cb43a8c160b3d37256716a683e5052192fd0e4d3cdaf30a10a9afa9d26d5d14ad216ee455627c32892a711d2bc137ee7a7df9a297f001a19e32
SSDEEP 96:Ivm7CuRPcPlXRZYIL8CzHa5nPOhqlW+HdxIo5FIox+Oo83L8FN:SmeeEPlXrYA765PO+dO5H3878FN
TLSH
T117A1529F139A60F9ADB8C0BCB6181AD3948CA172EB16398912CDC35D1E474D7B3735D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_russian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt
Size 6KB
SHA256 08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e
MD5 e04ad6c236b6c61fc53e2cb57ced87e8
SHA1 e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4
SHA512 0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331
SSDEEP 96:c5qCHRRc8sF+RZLqls1s1pzMDqAFoJFOTfNfKIik6IiVqOo868Crsk:GxS8sErWl+s1BFpg1Zh3868Crsk
TLSH
T18BD1005907AE60ED4538E05FE9086E0B3DCA91BF3B3B170400E86E7E2DE7426727A255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_schinese.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt
Size 4KB
SHA256 948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f
MD5 56dcf7b68f70826262a6ffaffe6b1c49
SHA1 12e4272ba0e4eabc610670cdc6941f942da1eb6a
SHA512 c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2
SSDEEP 96:/BAGpCOREHce3QuRZY7yezuqY2v14q3HPG9AHINL4QI04VOo8a8Jz:Sr+re3QurY7XfHPgNL4d04V38a8Jz
TLSH
T15D81E0AD136974F84539C1BC761C4AEB304CB032B6336C881ACAD65D5E8742B37B16A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_spanish.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt
Size 4KB
SHA256 c4f821a4903c4e7faea2931c7fb1cf261eba06a9840c78fdca689f5c784c06c4
MD5 66456d2b1085446a9f2dbd9e4632754b
SHA1 8da6248b57e5c2970d853b8d21373772a34b1c28
SHA512 196c2282ba13715709ece706c9219fe70c05dd295840082e7d901b9e5592e74b1bb556782181cdbe35bd1ab0d6197fef67258b09491fabc6f27606dbed667d49
SSDEEP 96:pFDVCIRRcJ3NkrHRZYGerQrmermz+ejnclLSG+oIq2K/+oIq2vgKOo8348o06:roISbSrYrybS3YlEzKazv938o8o06
TLSH
T173A1759E03DD26B89CF8C15E6A0AC6A3618CE173B521A84412DEC31D1D9754BF373685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_swedish.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt
Size 4KB
SHA256 4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690
MD5 b2248784049e1af0c690be2af13a4ef3
SHA1 aec7461fa46b7f6d00ff308aa9d19c39b934c595
SHA512 f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c
SSDEEP 96:cnvF+VYBVZcdOMuRZvODz1Q4EqvL8FdGPbII8ncswBIIZswpOo8V8pVKw:CvsVsV6dOJrc1qGSdGPsI3+Idp38V8vl
TLSH
T15591C05E4729A1F89A7DC1AC654D01BB18CCB03BE2622D4D11CE8B6D6EA741732FB252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_tchinese.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt
Size 4KB
SHA256 5e4f2de5ee98d5d76f5d76fb925417d6668fba08e89f7240f923f3378e3e66f6
MD5 194a73f900a3283da4caa6c09fefcb08
SHA1 a7a8005ca77b9f5d9791cb66fcdf6579763b2abb
SHA512 25842535c165d48f4cf4fa7fd06818ec5585cc3719eff933f5776a842713d7adb5667c3b9b1a122a1152450e797535fc7a8e97ebdd31c14b4d4900a33ede01f3
SSDEEP 96:MBS8ClRHcPTTeRZYEIlzEDsdYIaujGRXaFHJICVkHJIDVIOo8J8Jn:DT/8PTTerY7VK+4qFHGvHGC38J8Jn
TLSH
T171819D6E122D64FD493AD1BC7B0906A720DCB033B5633D4A2ACED25C5F1382F76B6691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_thai.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt
Size 7KB
SHA256 488294b7faff720dc3ab5a72e0607761484c678b96d6bcd6aad9ee2388356a83
MD5 53f7e8ac1affb04bf132c2ca818eb01e
SHA1 bffc3e111761e4dc514c6398a07ffce8555697f6
SHA512 c2e79c2505a6fd075df113ffce92ad42c146424ca39087601daa4ed15a2b5528d478a093921d9d8a738c7b6b963275a0693ebe526b6e2135d14ced03639d0e70
SSDEEP 192:MFlO83lYUUlM1aUl1wrYy5U55Z5I5vF3k5caR57jR5qf5c5AK5D7XBzmUZT5odWn:MFNw2AMy5U55Z5I5vF3k5caj7jR5qf5q
TLSH
T185F17FB7224664D4B868561E26193392265CAD623F73F8D045CE119E5AF270BB032FF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_turkish.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt
Size 4KB
SHA256 711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f
MD5 29f9a5ab4adfae371bf980b82de2cb57
SHA1 6f7ef52a09b99868dd7230f513630ffe473eddf8
SHA512 543fe63f791250e05e8fda24fd2ceadebb4c8925e8927de49ae490895c87eed3e61a9ad50237532649f99fe3165836261de215ee3f66ffbfc6d677ddeea7732a
SSDEEP 96:xnkgCvLRzchBmRZY6PfwEGcyDQz32cgRc1PqX0pVmbIN0P1bINuOo888SM:Rkv9ohBmrY68A3eXWRYSk3888SM
TLSH
T12D91EE9D06BE24BC96BDD5AE39480AB7518EE333F3316C4952DDCA2D4E1701372B7650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_ukrainian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt
Size 6KB
SHA256 3dd0edfbe68236e668fb308f92fe7c6493dbb05bfca85a48de93588f479ccc99
MD5 cadd7a2f359b22580bdd6281ea23744d
SHA1 e82e790a7561d0908aee8e3b1af97823e147f88b
SHA512 53672dd13e6ccbe96f6d4a61297c595b6d6cba8de92caa51ccf8ab1d8a82eea5a425eab348f295b9ec27de0026ef849d9230f751a46e040be8863923f91b8519
SSDEEP 192:RQqEG5oFQE3FqioFq2rYFdpp0XnZZSEbUFvxlDl2oC38gv851e:RxEoAQE1PAfM/pp0XnZ0nvHDl2X38gvr
TLSH
T15FD1FF5A036D20EE4135E1AEF6086A4B3DDE51FE7B274B0501E97F3E2EE3011627A395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_vietnamese.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt
Size 4KB
SHA256 15b6a564e05857a3d2fd6eec85a5a30c491a7553d15ffc025156b3665b919185
MD5 f350c8747d77777f456037184af9212c
SHA1 753d8c260b852a299df76c4f215b0d2215f6a723
SHA512 efb86809a0b357b4fcd3ba2770c97d225d0f4d9fb7430c515e847c3dd77ee109def4bef11b650b9773c17050e618008fc03377638c1db3393ac780b5b0bc31b2
SSDEEP 96:UWzvmCjzNlWR9cbG8THYCqrRZYT7zu4dbwfKKKX/TBAqLvI814zvI81YAqOo82fN:UMvlvNl2ObfT49rYDu4dUyKKX7Bns81D
TLSH
T1CEA1015E03A9706880BCC13DE60C055B2BDDF83FE3111E4426E9477D1E67463777AA99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
Size 40B
SHA256 0569bc417c2bbfe2b60b6425511f91b324e5ec70f02de579bb3a3681769632e8
MD5 7e88a01973014db4a910784fc2cb604f
SHA1 df5d569f5b8fb6830fdeca96547faac98f437aa6
SHA512 b9de58555702774787856ffc2d4b9b132b911aadac79ab1b5becb46fa803b9acf1975e6eedf02316e6b3714fef0a32d5276a9043a3fae8aedefb253614922789
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 5417532f9771cd9a1eb59978fbf0aeadc5084404d46ec8d9df18b83cd4be783e
MD5 614629ac9ea1e6fad7de67b5fd7bc3ea
SHA1 f341dae31e7bb5a9c367c68914a58a469b5839da
SHA512 3d494c137ccbf5ac24aa76fd80146adf26b8808b80abe644f2454ea3a5ba0fbdc6e14ac29aad0b2e5863b923f96019f0c34eec53d4a5cc2c744f6628abf0e0ab
TLSH
T1E2E0E5AACC21AC7715F847996054468BE74413562A40489F3B3C85484FB573A4686C6C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000b1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000b1
Size 61KB
SHA256 6896a9dc57a2cec40233664a3eb0e5818dcc02c93dba76a147f0be381f269f65
MD5 df287ab4fa4a07fb341a7cd483200882
SHA1 1dd23d8fbdd808756890cd03f6df866afc469955
SHA512 4672306d47718581543dc06bada55bb5cfe88ede3f227b7ceda9967ea7409c2e7a7247743de959e01d45b047d089583e942e7d5ef754c9ae4f3dc094cbae780c
SSDEEP 1536:INQ2NFTav3Cdx2fWntHRccskGRtxR4jb2oltq/qN3cI:+NdUC3btxPURyhltCO3d
TLSH
T12C5302DE5FEA064B946C35A9E0EF160C4388544F1AE6AC447BE6FF560C42D9C233972E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000b3
Size 69KB
SHA256 6cb3aac42ef05678eb1c7520cd19fe7227e4f00ac5562f590aeaab4dc61776a2
MD5 a478e91d4ff5f6aa2fe5d855209886f3
SHA1 e048cb2b2ca24ce3f377a7750db452120b5abcc9
SHA512 ae42507441a5849fc5f059324f2a71b4687bca46ff939001a1c94e483fc424ce82235ad7b1b6f43e78e4a6fd6ae8d8491049f448da849dec8efa9672f1f84ccb
SSDEEP 1536:sY74AtiObI13gTbY9GlByybFHvEPnlJqQdw0w:sEbGUKgyy9EP6
TLSH
T16F6302746F5EC5F1949FEA65BB3814E07752A8B902503C3403D544CB18A6E8CDEEA8F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000bc

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000bc
Size 52KB
SHA256 a7eb32a5531f42dabecd9547b0c1ae9aa48122e326e2e7f202ffef8c86bc7543
MD5 d807df553b125a77875c1bdafbbdd98b
SHA1 2898381b357b8bee4a3c5eaf7f81a91fdaa5205e
SHA512 6133cf354693d9bf27b8930e26a2d024aac8e25c4b233845b8056a6f30edb0bdd4855edff85be12d2430155bae7a67bd83bea57d0266fa9dbb6374a8cc67467a
SSDEEP 1536:lR/8J8PNGDfiI4JVQ+ODr0ispBqp34elaZj3N34b8:7/uMADKI4JVQ+Er0ZBqre3N34o
TLSH
T18F3302F816AF8096BF21AB410638DAA9AAAB5FC053B838DC7001D5BD71396174573EC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c9

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000c9
Size 32KB
SHA256 a0cf868f10fdb50bf6fbc3a6db39996bad046a87ca3f42c659297c3b93e81699
MD5 f74e99a1c1779144071116f51afd3849
SHA1 97b465e92f3da40e479a945363d63fa1439cd4ae
SHA512 22dac4f42d2850913b006bbd7669de767c8a7bdcd1e283052e8b87aa9da173d3c42c6e9585e1e262fe0b2e3bc02ff7e0e2d58875fb85f4017a2ac930b6abf4a0
SSDEEP 768:ZbhPNpSGiQqllDpS5Co+xRg/9laLHJNso/7NjnG:1kGqlDTo+a/9lsQa1G
TLSH
T158E2E11D57CFE437383EA2718A022C9D1AEF98ECD6A89AC61C46CFED0E14DB78955130
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ca

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000ca
Size 30KB
SHA256 8f72778351fb9871a2234cf279a56c5243a2f1af46a3d5bf48fa17ffedc57daa
MD5 eab670a2cb1e4b61080bc13740645aa8
SHA1 e994d829f29364c50750121e50ce0b4d77f1c7a0
SHA512 e86f6ef29c615aca7bcec0e290c412105f6281659f37b6cbcae371140ddd7ef6e02645e22f8ca8aff65240cc9d2b104c7ad82eb1c526960da097ece814074567
SSDEEP 768:IApJ6nqluq373Djh4wEgi4MSbpEmLvRkLw:TJ6q/jD14J4Jim7RJ
TLSH
T11BE2E0F535229F0908BFBB61D35B270AB4AD474E73F0069D39608D901992289D5CFAE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cb

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000cb
Size 43KB
SHA256 d7d4c7a99da6c4aab230838d37694e44870430eb4f21df5daca29a3a4e75104f
MD5 b85bcfa6838b824664012af2b0b93425
SHA1 606547294dc588bb188103f32faaee1f4c75679e
SHA512 2b30076c0387b99ff62101b62ccbd1be2a3ddd6aede959b9fc7633d1fc5fdeaa873d4e536061dd60a9480bc8324cf89ede6a6e98b4191a3e404b202d4b99d1f2
SSDEEP 768:IdkXLyX0YNseG/B5MnVjiMtGleSO2Ivmvn8xJ7xxqkiHTHjOmt6/Khrpd+IoPR:knseoEVkIuvQGHLjOmZRbj2
TLSH
T12B13F199035A7B79C1F810640F0AD8424F2D2B9A951E0E53B2D606F40E0D79FA7B74FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cc

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000cc
Size 46KB
SHA256 e2d50744e553a45e3c2469dc73c7deb787679c4090de89d6b86b28652c912fea
MD5 b26733fe4fa09c9116aacdb5d2414663
SHA1 5ac63aa51dae370d476e8c687fe3d6eb11e41355
SHA512 9d6cce82278ff48e34b009de959b7c486d66b48f56a26ec33211f890f7fe602844fbda6de0fa21191c788177010dbf45e1a87750cb824dafffe6facca756e50b
SSDEEP 768:fRdU/+9jgmW1jtw2iAwQaEiIyLbmddvFQMrRBd6isfnW14:AlmW5iAwQeL4dFbB6isfnW14
TLSH
T1492302FEA9CD58F2F89BCF016F96E0236A013656D0E048855780CE80FC536B1B56E5F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cd

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000cd
Size 62KB
SHA256 40b2bbf4744ab8c1737c8f3311a9a454802d0ae0cb7d0b37e8831171f6ad70ae
MD5 5683a0f4311097e896bb88019c30c222
SHA1 273fc57fe060c791e1de30854bb6193d29860ae5
SHA512 fa99fad953aab869e92334b409492f474cec66c10ba923697995f917163875b4d36e28bb733b3580a2d80803f324d2b7401c533b92eba27396a008fc16413102
SSDEEP 1536:PzdKgmjxM1QT62k/Pfh3+cWMHICKPAx2j//bw9Ubwag:RKHjxM0uXh3J5MHbw9sg
TLSH
T11553022385B5E062D19DD155E59B004BF0918DDF7EA65EB08B061AC7FEB8CAB8C80CB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ce

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000ce
Size 68KB
SHA256 9642b33bb9c7ea21a6899f653d58524667137016867ce6bfacaeadb9c88a09ce
MD5 9aa3c25090c0006963ca00d10933eeb3
SHA1 9e25ba8102c362300d56ae7f66da38ebcc3377bc
SHA512 8e0b9c8d45df8be2c9f7a9bd16fd0a8e557be352ab1cd630c88abe54fbfdc70fd90cd00d8697b484e83a2bbd8874ed16f8ba7e0ca0d9e4c48b2a426b3607d02a
SSDEEP 1536:OkgSIeQn1OE0Md3pdpAuH47Qb49daptQYjOfnFJlfzRAdQlDzaKOS8MO4F:OnZn1jvdpAuHsQUxNJlavSLO4F
TLSH
T121630223D499A461E875D23E38E8548D140CC724CAB79B3D987D5C4FBA27867C34FAC8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cf

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000cf
Size 159KB
SHA256 f100f80d32ff0d850a1fa92c33bcceeb74f401d36ceb77e63c219814baf07b6f
MD5 d87c0d93822c82e6579d1b46a66c4615
SHA1 c41996685342972e76a90487ea63674b5c9dd0ee
SHA512 83a84f30a5dcddc46605a4ed05be2f350a6dc0d31c581e5e1d29e4ee06c0f416b1a54ef4e63148f6bab9c09bf28d6ca0ecc6b17797b773c2d87ba4f77cbb9a31
SSDEEP 3072:5JuRLlzp8jtyh2kp104a+yB7hnU0AziRmL9xlstcqwKPOkwOzw:q9Ojs9e4QFWZiRmL9ecqdPOv
TLSH
T1E4F31345B856857AF9CB59BD2500219B2A6F0D0B8F5F0B80E65AD3F32312FE117FE190
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000d0
Size 23KB
SHA256 8057cfcaef5055bbe95a0cf34ce83c2658b35c4bb4a20280736b862b711f06a5
MD5 111a2028692ee77b434d238fa008f557
SHA1 64dca0a934c9c53b7c123920ef6d469fde3c7a25
SHA512 cf075226cdf5f3f2fd79aa9944a61c444baacf92f7b276deefc786f0280b2eede71a6b82c52e758b838c67d482be5b88749e9c10258435482f3723ede48a5204
SSDEEP 384:enQck7PXExLkQk8t9fx/hnJlwlbmfaYNM9fuKeq34b435izKqcyGR15MrElY9adE:mO7PmLkQFv9JWmfTN2fuKw435EKGOLMN
TLSH
T1E8B2D0A9B1FBD48DE8F3D89849B353AB413A413346E7DC8F0A6E86A540B04368D46CC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000d2
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d3

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000d3
Size 18KB
SHA256 14e61cb344ede086213db4f264072f1372f2dba26dfffd6e36df9d815035cd7d
MD5 6f96022cccb0753e4ec5cb45ec4f1f06
SHA1 8bc42c6043e4bd4771a5506ba0e44d1693da4202
SHA512 aa979253eabac271f6d0129f394b28f9f6e14c3512bc1abeebf0e37dd7c920f5b14b58ca734ed66d5b62ddf33dac369eadcb0593d90be2aaeedb3ed350b4042f
SSDEEP 384:LcN2za9w1AC0VNm8DwpQ73pBIQTXqbX7Kr5yiBD/CVGbnkt:aHDVnDz7pBRTqr7u5yiCVGDkt
TLSH
T11282D1FE91FE0F617C9B703BE04DA02C4601715BA978365E33B2ED086B25DBA5126E4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d4

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000d4
Size 59KB
SHA256 1b7e8a5bfeac7825cf442925c9e75ed38f65be1024c4764454f6eab0dfb9d4c5
MD5 ba853d025f1d86fd71196186984e50c8
SHA1 bfa1b79a865b5bfd119f536639b48781a5b4ef22
SHA512 12e66f23a86f04240023833d943469f124062dd83c43c5699f3a147a667ad37c80c4f79386c9441e84358cf1172871710aced24f747c5e8382335732a3de745e
SSDEEP 1536:hMVWXNx8/RfAZhyb3uao0HoO6OmY53mgBSe/x1CWAuu73:YYx8ZfRb3uaHHoOlcgZC53
TLSH
T157530244E7BCCCBAA9D48AC05BDDB6717391620F219231997F644D1FE28D60A3C8B25F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d5

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000d5
Size 29KB
SHA256 fc86cd75266fa50b0f104bb268daf1d5cfa7978428c3799a58cc613bbd2fbd91
MD5 c4290ac4eec60ba825fe6150da439298
SHA1 97c38477e05038dcb67901f61da37c46c60088ae
SHA512 9f4133be5c2bd11cf704af6ed7486b21a803c289feff4c97a1a9671133c7ac422a681836fcc11bb0a35aea72eb5849e244392ed21764425fbc4eb6b13229f828
SSDEEP 768:24swZ8OeFS1iUZRD7JlJ/uKsZ70Tx/ApJGyKg:Xsy8OeFHcpJfXsZ7448g
TLSH
T178D2E0815D80C768E1F24EB16AE10484BBDE69AB9B7821921D753384FE1FF21532B0E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d6

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000d6
Size 48KB
SHA256 0460c4843976b65912bd6d64f00ed6817dcba7647c4defc8a77c6221e025784e
MD5 3364c9b0c1de30bea39bb360220e5e8f
SHA1 41acf2eaeebf312a597cb96752ef68fa655c4e3a
SHA512 40a5c33f0f9529426228a2ffd81179e1b67d157a39b71593f16fb0e6e7b5e34ea25a5bd6b45fa88e0937539f73ffa6e12d151997cbb567f86fc3c78d0f94563e
SSDEEP 1536:o9Rr8Vcf2KtmWw7t9neOa96XXYDOWu1Qr:oD0cf2KgJtxfa9eYiC
TLSH
T1B823F10FAD092A18F9334EECC34962254D1A540DB2FAD2A3CB6DED83B5A5FCE056171C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d7

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000d7
Size 98KB
SHA256 de2dd81ea13c798a8b5eddca03b650cd8ad525b5c8529f9d4c124774f5b20a5e
MD5 9b97a22a1fe593c476b2ac9b334f52aa
SHA1 6a068298e172929cb5e7ab6da2b24ea28baa4e8d
SHA512 8e341e7c169e65d29e5e3c1f7b94eada0a7bd7698dd358b6540de5f5d27e098d0ea0442001e23a724958dcb91cc910cfcdc4d3bf4d05d192a06519e794548b98
SSDEEP 1536:wtCTjkMbjUGeF7sBpGVWQWqJc88qianJyFbGl2Yg6jA64o5ulk3wyUQdZ+WokzR:7Tji3kB6nEJFP6jFWOxUQ/+Wl
TLSH
T148A312678E83DE6CFFDA7C9B41BA471D6C840D6D1C102D835772142576ACB36E8346B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d8

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000d8
Size 18KB
SHA256 8709fcfa467c3e4f684297ee087a5205340adba8c30579e1da4a7a9e40c48176
MD5 8cf1e4ebebe4216e096d599a5492aeb9
SHA1 6ca93a08d2917ae4b3c6ced601f8d09a456bda9c
SHA512 9793bdb8b3de580634ea0f3d6935e239d1f800cfd453522f3ecd937ecab257413e9c9204094ec831b9dc2f90fc5dc155e51e06a665f7ef1e1b6cbca4fb991ee7
SSDEEP 384:DlrAl3aLJ+lHuLconfr5b4WEdU9hHfMhuBsuZI5wRUAt3PzJ65VrNIEdMkm5OfMl:dqa0HicE8/dkhHfMSIQUmITrNX6Okoc
TLSH
T13992E07D4138B68ADC80C598877DD10EA35DC2C3F01538ECB4965287A4B29DCF39EE95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d9

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000d9
Size 133KB
SHA256 1f2ccbe95963bf2fcde87c9151ec0a42dd3d95be7de91e2e7268139fdc98ac90
MD5 290c5372a517c81bb0b63e3061166908
SHA1 abb7e6f88e96db15f5c3b4d04b0b3117c3093ecd
SHA512 b4bf111f8c0f4a8c5d09dda46d9d0c0bc56a187f58770d5631dd218336ffe6dc281b88ac1dcb87bd719fe387a0ac15303de61d615f9729501870527ffba53b0b
SSDEEP 3072:E2UEqXdb3G0Y9IHax32QNdN49iV+oxqfec1LHU/IEkpE1eXlshuE:DqE0Y92axRTN4IcoMfHjzvE1eXlswE
TLSH
T1F5D312A91D3B90DBA5783904ACB03284E5F5785BAEA5DC4F958498FF300B51E36F2CD2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000da

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000da
Size 85KB
SHA256 64962e6fb7a135545a250167eb0e2d4a7940468ee6146665e9eb11aff4db9c38
MD5 c2b24a8d715c1ca28f4ebb90ec275076
SHA1 925a74c4062b8efa200ef9c80ba8da7d7cb7cfb4
SHA512 595ae4ef2c8e9ffbba54099265182909e6ecdf2816215fc392a0200a450298db6753c00eea94ec36ca969139379959fe6727b9b9c89593569ba066c2ead76555
SSDEEP 1536:ek9HsnWwAZdBgnhGZRknb/dEqckhgrTATT2aWfCeZe9epCQ0amPoPu:ekunvnhUknOkhYla2ZJpj0oPu
TLSH
T1828312E67D977C3AB18B58B38EE736B780110D71E1F2EF1A047D132CE05589CA8296D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000db

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000db
Size 86KB
SHA256 d6be9d7d0962e6a8193a94843be1e9001d4388f63e58b455120b44809f42662d
MD5 b266eeb59bff42ba6d0ac2218d0eb0cf
SHA1 bc283fa17256d2dc964e62dffe41cd0fa88af33e
SHA512 122c6863d18716366a19b55594d9479da8ab0a19ecfe2098e52cc1455f9e0d33a3568fb4f1b778a9604a092371c76fa665a28f2080318c89bce44e841e2aea1d
SSDEEP 1536:yHjt3vYWBSXrJ/ll/S0+v7aYIrTlZ7VBnIYa+bIX9+rtQjHkuimAXs+TRbW8HRhH:yHJ3vYWUnl/3+PCTlZJg+bItmtQLkAUV
TLSH
T1AE93028204EBEADA9BFDC9A759F531008483DADF2399F5694C6F7A1CB9F10481428C2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000dc

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000dc
Size 84KB
SHA256 f1aa86973ae49b271f07be433373ff87fa5355b6ea5bdbe66738c48ac8608a83
MD5 0ffce21bf5e8b0a87a78423f36b612da
SHA1 55d475d78b8012533f06a5a9b6f3beddaadefc37
SHA512 e7095095fa9ca7a75378dae5dabd38a88a9e0256a7a8e9b5c58e951e4359b26671c2488544370f047fe994914a400b123e56b7963e5942546eaf688f647dff7f
SSDEEP 1536:1doRPveAg7NrGXUGljs+LXBjQ58N4Iqc1RhSenl+Snwi6ohFnElJOPkiUVNcaFTo:1dohvRgxa/jzLRUG4GRhJ/jVElA3+SaC
TLSH
T1558312FAB3FC7254267378B157F4B869801E5903932878EB0E7D51C0D5B1F235A98879
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000dd

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000dd
Size 34KB
SHA256 e170dd6d991a370b5307b9d8ce61ce510a6249702d025243b763fbe8b843317d
MD5 65c98ac99685b964988dc8e837246f45
SHA1 b189e70e53a9f243c6a0a441e7e4a2e795975754
SHA512 b0c71a4a291c728163d55e694009a575e2cf8dae2f9fba9e3af454605cb3a7a9ef6f329fe49e015f1a610013a35c69ea684005c6bd4c1812f46fdc90803a1cb1
SSDEEP 768:lDEqmekVxgT0urPmqZOM4aql1aAwnU8nOAIWdfEEt:uqQQlTmqwMJql1DAbL
TLSH
T12DF2E154860BD8B8677AA47F42E36EA43724DDE01C3062D974A4E3C53CB56E1F475E24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000df

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000df
Size 41KB
SHA256 93c33e2b8beb9d4856ae2d39fa885478d0fc343a8b7488a722937f6a4cd4e2a4
MD5 8d9ab49176380d2967b36190f8ad366e
SHA1 b27f13b14e9b930c64b5d379238a43e552a39978
SHA512 7e419ca154871cf3dcf99407185245e702db9671c396b0172b35d1442c94f5d622f9ca390aded7d82fc3755b246723d348b663878bcb8472c3c4f1cc3983b407
SSDEEP 768:0CYw7YxJpKKMdUjCHCN4iA5aihIDpCkH4rKLu17eJYBbppQNJ/Ub:9+JPzjy6qai6pCkHPaVeAbENJ/Ub
TLSH
T15F13F1434B55AE57C0C38BF24393C4A6EEF35E65793855843E35B3880B78CE4D6A0AE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000e0
Size 114KB
SHA256 19d410cf923f8bb4f081f400fcd0083a5edf8f380ff21a5c3a8d11051353dd6d
MD5 13aa516157d50e05b815d890cba600fa
SHA1 e5db9937574c4050d905b36dd4d8112c22ba83d9
SHA512 f1ae97c2917c7b27964ebab9530ba4918a02f5299c162d77ca92f51b76621ea074cbe41f4dd4f82508a0897761fdc8c0f7d3d442ec3ed62eeecab7e266649a01
SSDEEP 3072:25KTa8bNuyLN+/vDWcZjuAIUXgrnUZdU+heM9PoJW6A:gKm4NRADWcZjuAIsgDUTFp9wY6A
TLSH
T107B31234E536A50144055A8A84EDB97F16652BCFA0EA92C17E7B14BFF783270B7E01BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000e1
Size 75KB
SHA256 4b3156b02fd254895841677ff53ffbebb96b6012bb7c0a49b0ba47d140630b31
MD5 016c7230cea5d808a2355b9890bc309e
SHA1 150d998b45ea1b21aa321bce005823bb3d7952c9
SHA512 3b27769b95e9e04e1c8ca04c449c2e275cbbf007abb14221be1a00d77df419a8222015086749fcc9539ba02504df6e1093855897e2273de14f14c4f1aa319c29
SSDEEP 1536:rYdZDbmQzRgNgxdFoYe/6xZqW8gmMs+n8bouSNsSAcii+oBBKyTkBt+XRwzNrrE:rYddmsRgaFo8xZq018bGNsSAciilLKwV
TLSH
T14F731204743C975BE1A986F84C07130563B92FC5E944808CB2AD7A7EDDF92BF92B6498
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e2

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000e2
Size 54KB
SHA256 bc82d9345f5b758554f7532f8538cfb1fddeba1e7e68347f887eee18d2c7fc4f
MD5 2e95bc2428d412bf0d62aee48b52bd98
SHA1 22919f98ad5d18774984a777e44650b2287f6fc9
SHA512 5a565affa1d471f5bc673476a2b8445efd05607ee5a0000ee18cb5af6dcecdd9d02c16f7091ecffeb5e360449e5604349e712b44cba73d93e75ff4e46efeb8b0
SSDEEP 1536:oC8jxfBlBTs2vhcv1Js+r8qjHakHXgNWuxBwAi:b8Plsjs+hHayX0WuxBwAi
TLSH
T13143021342A2CF72C5CDD7E1DA2C3A2EA464EA39092F9C0D5627F5086112DE9EC6225D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e4

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000e4
Size 30KB
SHA256 f5498bea594eb27d69741b0b17f55f585b30fb987a617991b6b687ca4645f5eb
MD5 d0ddd94cc112845504270dbc8987e4fe
SHA1 936c50d14e087599ba80b725ce75b71730089038
SHA512 87c8cd75ba6e89c71f8eb336c29cd40a444cf54b149c4c146890f00025eb65a18ce433a963dee3f7e273664bf77efe8d0baac943e8b1d53a3b1021ed049b34c0
SSDEEP 768:LVNdVxG4/nO7olrCIoG8WyuEz67bPgXmXTFWCkFYAQ:LTXxG4/jENWZb9BWCk2h
TLSH
T106E2F0493FF8629BDFB8827F131038E0914207120A620A5E7DC9BE8ABFF7C9A5055E50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e5

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000e5
Size 249KB
SHA256 bc6d6b75d261e277cdfddd4ab3af2e797973b9e4c3cadaeec24492824914db0e
MD5 154e405c180cccb026a5adca3f29c412
SHA1 a045f108bc5e2ccbfe1a09d76333ed1c3969ce55
SHA512 af4811440405f0c8d7aabd6c64281af56193155b382f3433e38d0a0aacd45558e293eba80aec0a695027508d72c990ff63c97022afb952f3cc9cfb6fb8ba0829
SSDEEP 6144:3mcen0c3IjpySycf8KeBSegiCkzXFb+bdeFleo5ge9c:XenXSycf8KeGiCkRbYdMeo5l9c
TLSH
T11A442236BD245DB5A8C4F6214E7BEF3B08534E5C4E738B16422E94B2E5B50FB0AE06D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ee

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_0000ee
Size 110KB
SHA256 c7b2bf22aecffc7180211a2dc2e8b1d8c8ca31ddd3a40fa71a182681d60429d5
MD5 ff86973e0ef15bbfaab3da8e08c4131c
SHA1 d02b81de2bff5b7c545b8048c655587d21f2d64b
SHA512 2fb0ba89b35586e29ff723050bfd50566f244edb5e443d317dced480223b1990dce9f4d3d0d9aac48937bd48ee7ab15974cdeb376eab4f5b573f38272dfccfc7
SSDEEP 3072:1KdiAVGk72Ji8LtEIk0Nnrbwk8pV2Ag0TC4YiBOoJcba8Vye:gtQkqJir0Vrbwzq0TObDVye
TLSH
T14FB312DEC9518ABBEC1260B85B5D855D47376ABCCB8AD5D3B325B1B3305C3082532A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 f994a88d6985ba761f0fd5c8f4184df227d3d43fa23dea436452014fcf301128
MD5 ba8e2ba5538b1407126096e431da896e
SHA1 c2bb4d3ef67355d208623d59c22cef50a174fd2e
SHA512 61f3514749b9696970109311c3c42a8188a12f290f22b6b96b3047344f51ed8ba852e007eb376c5c55a9326cfa0420ce15e0b2bd6f9f121c1a92ebcfd7e06428
TLSH
T1A051ACFEB1D56AE3FF68007DF8B07DA0384022A129D103275DF2B77116976E187A64E6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 376423fd7be22f3d78b8a3cf1063a2324234d51c6b4965fc0ba8846688244f09
MD5 64dba25c47b3d881447bc34d3551565e
SHA1 94c40c2b48402eb049b060aa3e0c95f3e03bb7c4
SHA512 348cff87afc5266aa0bdab4b8b8c071d7310154f9fad5633e0db5fd42ebef83ddc2b35060bdb34184dc0d2dfa7e35d668db346e6a23fc175d0205c9edd3e320c
TLSH
T1045169CEB1CA7AC3FF68047EB8747D603910319128E007275EF2B761068B6E197B25C6
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 2c6a930e69661817f129ca2266e20b5d2ae3e6c2772401077e4f3e5f5a64a491
MD5 3dfc8c7a43b53d4ef0e40ccb68ace83e
SHA1 050213d9f47e10bd89e3d4a177eab2521c2ee450
SHA512 6c8871bdb51fe9856b2d5bf5cf23903f38c3e88e4771eb6e11082dc6b2c2f9e893bfbdb4ff5dca21203446e3868c6d85b3341e29e64f27d756357e43685864c3
SSDEEP 3:MsEllllkEthXllkl2zE/lcKt/:/M/xT02zle
TLSH
T19644041D7FC04407D5005130517DC3503370D4110713574334F114735CC5F440C00441
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_tpi.li_0.indexeddb.leveldb\LOG.old
Size 374B
SHA256 aaac57953a5648ba61b78e2ef50bc3a124164ec7af9d0a954050ee6d2fbaf1f6
MD5 5006cb650602a5784a848cec1fe16404
SHA1 bf52db9d71be920fc81d3a0468ddc3bd8d277f98
SHA512 97fef010677f6ec15265098a000ff31b0e5e29a8c43a2ea7bbfed421db5072ef34e92b8fad9d676bb85a63d65c2a6167e72a407be60516efd874a2e523fd5975
TLSH
T114E0925474ADCA9FB2E5C22762B8BB4C8AE33609BBCCAE555B05E4B075C440451A8670
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old~RFe60a5c9.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_tpi.li_0.indexeddb.leveldb\LOG.old~RFe60a5c9.TMP
Size 333B
SHA256 69cffbc4c20bf0ee3636f1fd25a4c62c5bf4ad47f09afc74549008cee29cb8c9
MD5 21120250640a42bb31e2256b51de818f
SHA1 4e5f0098ac65c91af94ec6a9eda2c734f7c3a46d
SHA512 c798236ee4e7f197a9a901bf83aeefc4c7cf73dfa53fbce231aea89e942343f9ebd7510f014053d1820623715204b23edac4934624aabee6f76d6ea667c3263a
TLSH
T1C5E0201475D9CE5F51E5C2662534BF4FCAF35509EBCD6A094F41F42471C5808516C7B0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_tpi.li_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.aliexpress.com_0.indexeddb.leveldb\LOG.old
Size 398B
SHA256 f84572a059b30895972e728ab1726110b20e0849b72f4aaa7edd3a535f6e30b1
MD5 fb25b72cbb24e009f5a27dac2a1cbb4f
SHA1 d27cc6f931aff47790954dd0f81c92f73ecc5272
SHA512 b3609b6be1c198d9d1e26a466ef2d7599c38eaa9e599ff2d830587323cec41e119f1fb06c393c2e20f339ed05cef3607967eed881cb5b84f5bf4b3af43e45e41
TLSH
T1B5E023AC39FDC65FA0F4821B3175770D89E3350EA7DD6E811F05E47071C644451D8560
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old~RFe60ce9f.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.aliexpress.com_0.indexeddb.leveldb\LOG.old~RFe60ce9f.TMP
Size 357B
SHA256 c91c0eecaf413763d7ddeea7f14538f27aaffe784b18153c2cb2dc5f6b6b4a41
MD5 40613c4a58e041a56abb36741ce5c305
SHA1 7f74a64a4e4429e39e85973ff3868e10c1a82878
SHA512 2f1e7d35ce42ecc84e8d553ad1683408272c015cf31ef526f938f5a6767c41a2e2462cef233bed75f17ada8e05274a187c7048116ea2cded5463eb76c76d071f
TLSH
T168E0D86CB5E9CA6F5194826B3530B70E8DE3150DAACEAE851F45E83871CA88854686B1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 5b4d0ce55608e92f0d0c550fda8e2f1c10b8a6912e80fb03ef14d284ea24399d
MD5 67a3d19a57ed17f38ad71cdf1ca5b5bd
SHA1 f2c3766c8c1d88e041baddf8051c58e368752503
SHA512 1d62b47622e54388b74851cd1d99d2bed09270f853da905e04f9e95f5c96904d90451dcc0e2637c341199e1f2eece6d74a9ed0b7f3159770e207b30b458cab91
SSDEEP 384:D0uwZJESEFfIMcSAJ0OQ6SRnaIzYUIg/omYUEd7EdeEqEd/anIX1IVIvI7XS68FL:Sq1wsRgludx9dSIm2AwNPYnW6IH
TLSH
T18162BCF7C3E8CA2DD91156F8AB156E1ACE1D0A14532C3C67C9D8BF1B93E2871E21164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 f404dff18bfbe475d2d477a92dd2dd048dff051b1df9788b653baa67de630d55
MD5 bf9b3ff81575a229bf948df97e9f760c
SHA1 c1ade870f8c719abd8d1111e675609958e3a0868
SHA512 2cc367a0b86a7dd71f6995235b00c9ff0e1c5d7d3624aa77593d6d0ceeda0a1672a285f4d4fc3b2afd5cf0f54181b889f60ba6a3b05758fa02eaa990f98a8bb0
SSDEEP 192:DqVdmVL4taIzhvBsEVyFQ+TNPwaPifPSlNIg/omVHm:DqLmVL4taIzhvBsEVyFQ+TN4aqfkNIgq
TLSH
T14AD17CF7C3E4952D891196F8AB156F1FCE2D0A24132C3D66C8D8BE1B93E2872D21175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 5a173333250b1a3370fe1644bdf155cadc4606012ded6510f3c4a2acaf24e705
MD5 f5e5e3ec53285d9f3bcc638502b27a7b
SHA1 0d7f295150faa6dce37582e2b993d553cf1b59ac
SHA512 8c99063f49100bfb10057911886d099efb4dad54a6e1b337b2e5d5c5442e575c487abedfb71a1eb51c2342a9a581a25530b9df0513fc2b0545542185dfc524e2
SSDEEP 192:D0umitqwtUJE/7E/6aIzIaUIg/omYUEdsuaSXNPwaPcfPiNZvqE/VeE/1AE/VY:D0umitqwtUJEzEiaIzIaUIg/omYUEdsj
TLSH
T1B6E18BF783E4D52D8A1196F4DB116E1FCE2D0924132C3C66C9D8BE1B93E2872E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 66ea97e0645744432e44617d0dc39a5ac64ccbee4eb1b07d48ad46219c168962
MD5 40fd32c8b07d81b79ac2a8799de1f38b
SHA1 df31c34f89c936926fc93fb6901dd75765cd6452
SHA512 2022268d2ae318109dd4c4a01b5720381a0644ce251be5f160b82e4300e4ecf437451f66b902aa71bf928f41bfdd07ecc6dafa7ea3377ae3ae4889fbad0b2e60
TLSH
T173115CE7EB7AB81721AC09FF1D44744E5A76B432128168F6DA97436CF0D19E70F25053
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 775e80bb64b00288889e9f7dc9befe1b05583851861a071932af8bfe6205bece
MD5 6112b185e47c451ec9d5ac7395cd24cf
SHA1 7f30d1bbd5cc958653f68404149ef2a058a61100
SHA512 833d485347f3caea9e4289e79291062bbdb910d84ed5f95247801877725757d63a29d5f9bded610568f7b9cf91f14ad77e8d98e9f50de047877055cf5ea154f0
TLSH
T1D9115CA7EB7AB81721AD09FF1E04740E5A76B436038168E9CA97826CF0D45E70B25062
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 17KB
SHA256 cd051116f373a74704240b620605e4b5aa52b5fd5cebe28bf28a2ff6574263b8
MD5 896be56ec46e1e675d9321be8461f352
SHA1 2061f1ce1d103b189597f191a3664ca43b7221a7
SHA512 8c71e243831f19a5b36515d3cf27ff3b86fa29ec14e39c793f0d73aa7f216c2fd1f8d34390ff8c3ef594487bf299b90847698e02e0c3e58937a5d2311a0bed52
SSDEEP 192:WRLcBhGT7ka/UF5v7ep0PRpKgYGVC5wY09wHsb+WNJCW91VjR5nx01wPUaGV6Ea4:WRLmhcoFZ6UXDOwntVUB6JTEW5e
TLSH
T1AB82B76BA4202A7B98EAC62DF811F79BD3F5206266D45E80BBFCCE1C15D76DC210741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 b4a810fa61a2db3f75b46d0b0b639d06f199bbbd6a3109766e70b8028a73b0be
MD5 aaa45a49eeea13ad8a0a0bef8b54dc4d
SHA1 4fdbc22a5da7e77001ac02edf2f00cd1b864500a
SHA512 8a2fd6b3fd4d70b95c2e59e0f6fd18032a09476cda368614f3934329cc93325c118b498af02471bcef474253970257ca4132030294fbe6ca175ef727b76717b1
SSDEEP 192:WRLcBhGT7ka/Uu5v7ep0PRpK/f5wYU9wHsb+WN5VjRhPwPUaGV6Ea3w/kEWRIxco:WRLmhcouZ6UXzOw5tkUB6JTEW5e
TLSH
T10562A52BA5106A3B9CDAC62DF911B79BE7F5206226D41E80A7FCCA2C14E76DC211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 12KB
SHA256 4c76a24cf83345c4457f335b6dfe8c83a94f59460f6454ff1a790f02b0e26836
MD5 92f456d9704822cda706d306f0ff5082
SHA1 697a3072e729b9f6167ef262f244a508df898c1d
SHA512 f027af63fc139f37c86ef030ed5712a015301c5bc70eb9289a695876a581680c7388fec0e37bb2527cd2119013b57b9a1bee9fc3548549bb4b892a8b77a0ff6a
SSDEEP 192:xR3hTnka/L/v7+pAPRp2/Y89wHsb+WNn5Gx4KP2TRIxZHVyIsnAUgtaJ:xR3xrX6UXMOwEd2tE8
TLSH
T14A52C52BAA50663B5CDBC329F921B757E7F6107121941E84EAFCCA2C18E75CC221752B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 e13224070dc4cfc20d9f3935954e82ae1bef3fd7a184d53661ba01239614e3c1
MD5 cab5335456c477c87f234fd0334ea27c
SHA1 68f43657064ae2f417054d1bb38f4d5da84db23c
SHA512 bc1cd25f978f108e1a518f6ca9dbf2434603eacf3901ea034461a24979c9dc9daa4f013457940c211ed1332100cf63d82faec5049ea51e8493c3d0f4a7eb2dcd
SSDEEP 192:WRLcBzGTnka/UuNv7+p0PRpK/+vwG9wHsb+WN5VjRhPwPUEa3wl6YxRIxciVyIsB:WRLmzc0ut6UXhOw5tkUJTYb2e
TLSH
T1F362D62BA5102A3B9CDBC329F911B7A7E7F5207226D41E80A7FCCA2C15E76DC211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 17KB
SHA256 b037af6186c38e38b4872c91f9f6356becfe5311faaec89a5e31998fc321b7f0
MD5 9482982f519c026fb51819fac4591f3e
SHA1 37c4eb210a10e6dc6138ad1c0893094271901e92
SHA512 4d43273199247dd3794348da67b110ae9a57b4cf08fab1697c786649d65b43650c7921f1ff8a817c7cea0e84dc9ae954f77d3fa51d667cd0347c22372d215407
SSDEEP 192:WRLcBhGT7ka/Ug5v7ep0PRpKgAGhr05wYP9wHsb+WNElkx+VjRjgMZMl1wPUaGVh:WRLmhcogZ6UXCOwqt9UB6JTEW5e
TLSH
T16A82B72BA4202A7B98EAC62DF811F79BD3F5206266D45E80BBFCCE1C15D76DC211741A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 ded5cd505d1296343d821d7ad3ba264851aa644f61f95fac94af9545c14873ac
MD5 44d026c4c41db8cee775d592f3c22617
SHA1 df283795f89f3f73fec7fc3979b9c809f2ffd431
SHA512 a7b57170e146ea42096c3338f26ceb3a8669a7c5a64fdcc079a6263ec0831f9beaf960fdf4d197cfd6f6cf4e9f3662b04d4329176ef801fa20b858e44c164ef4
SSDEEP 192:1RLcBzGTnka/BNv7+p0PRpK/LPwG9wHsb+WN5RhPp//Ea3wI2WgRIxcNVyIsnAUp:1RLmzcht6UXmOw5l/JqWA3e
TLSH
T16B62B52BA9106A3B9CDBC329F911B797E7F5207221D41E84ABFCCA2C15E76CC211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 babc284a33f42abd957a5cce6e61cd19a0d8afda4c4b45a798c2e69df369fda9
MD5 703144cfb3770c53328da222b6dcc578
SHA1 14b2bda9a4ac0e1cad0d220259fde6baff60e86c
SHA512 ce50575cca01ef56954b5e740b08778210003b23df9b1eb6a7da02c5d4b612c63738e806ad15b8b7bc6d4b50e04791fa08cb86051f25fa67076af3673708033b
SSDEEP 192:1RLcBzGTnka/Bcv7+p0PRpK/LPwG9wHsb+WN5RhPp//Ea3wI2WgRIxcNVyIsnAUp:1RLmzchI6UXmOw5l/JqWA3e
TLSH
T14662B52BA9106A3B9CD7C329F911B797E7F5207221D41E84ABFCCA2C15E76CC211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 b1ee3c89462d6eac347d712946d0063152d24de860feb4602063e74ea2117b86
MD5 1b002741213087802a87e3cd35afd4ff
SHA1 15224e345f505b8f261f64f7720494093ba872c4
SHA512 5ca5459915b15356cefc772f316b9d9fef21c1e43b02bcc2cd44ebae8ed585c50708f4c74543b7dfe512e908ddfeb6c777095c1a720ddd58ce620f7196b880e5
SSDEEP 192:WRLcBhGT7ka/Uupv7ep0PRpK/f5wG9wHsb+WN5VjRhPwPUEa3w/kEDRIxciVyIsB:WRLmhcoup6UX0Ow5tkUJTEd2e
TLSH
T18C62B52BA5106A3B9CDBC62DF911B797E7F5207222D41E80A7FCCA1C19E76DC211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 5fb9e3805c4841ff223e74b50fa93443004a4833b11a856db576d37b38762127
MD5 c49634fc69b5c5466c65681ea706d33b
SHA1 b77179b5e30de12aeed0e749327b358c06217fb9
SHA512 d1c02617aa4d861ace72b79e10cbe0b5cebc6f21bd355dbe10ea91c20df4fbff671bb7a3da807d8661cab76d8a7f2c146c3d0630b5202ba14ff6af6b037be0d0
SSDEEP 192:xRLcBzhTnka/L/v7+pAPRp2/3oi9wHsb+WN905Gx4KP2TRIxZHVyIsnAUgtaJ:xRLmzxrX6UXqOwbd2tE8
TLSH
T18F52C52BAA50663B5CD7C32AF921B757E7F6107221941E80EBFCCA2C19E75CC211742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 650f035633627fb4a650142701c66092d2578c261b9a4f8c7571eb9b3d740fb2
MD5 1cee74f34649853d60f341421f9b72fe
SHA1 d8b5454aa3d782f17434858b2a7c5494bb4fc0f5
SHA512 5f209f962c0390d6598fc06101b997fc6fe147cc6c837344619b1f94616b6ef0966bf1b8f984d0c1a817856b937d254aaa5989c88949285911acea53b25e95f2
SSDEEP 192:WRLcBhGTnka/UuNv7ep0PRpK/NHwG9wHsb+WN5VjRhPwPUEa3w5+ktRIxciVyIsB:WRLmhc0ut6UX8Ow5tkUJDk32e
TLSH
T10C62C62BA5502A3B9CDBC729F911B7A7E7F5207222D41E80A7FCCA2C15E76DC211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 1ffc1b5391a4710479bedf125c04ea61c5749947366d3b257e661115ec89d381
MD5 a900dc2c680dad1baba83f616b5f9a6d
SHA1 4ed6d9939f5388ad92bd9155117e47e5a9d3742e
SHA512 12a12bbcc31c0f6f90b35f800b136c41cb0a48b9eed1a2a4f284e2ecd5e224ce1757b785c4443f8826a7fc767bb4e77bfe33810a6e0c32d6e1816e8c3a215558
SSDEEP 192:xRLcBzxTnka/L/v7+pAPRp2/3ok9wHsb+WN905GxUEXI4KP2dRIxWHVyIsnAUgrK:xRLmzBrX6UXMOwbURd2npe
TLSH
T1AB52B52BAA506A3B5CD7C329F921B757E7F6107221941E80EBFCCA1C19E75CC221752B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 15KB
SHA256 76522764050c6b0a6a7b29d056fca241182ce7b76a30ea23c32928c48f4553ad
MD5 d165ac516f3d26349502cb23649e0b6c
SHA1 2f67a6c99c236c1bdcd8c66a2f52d16f1531e983
SHA512 bbe2570b0d7556adaa8749f65a0eff9d21eaab6c5fa9337792739e80ef087c0734c4d60f7955074e42eac7ba18f5872e1b46aebf8ad3cfd492358f76baa62725
SSDEEP 192:WRLcBhGTnka/Uupv7ep0PRpK/NHwG9wHsb+WN5VjRhPwPUEa3w/kEDRIxciVyIsB:WRLmhc0up6UX8Ow5tkUJTEd2e
TLSH
T15A62B52BA5106A3B9CDBC62DF911B797E7F5207222D41E80A7FCCA2C15E76DC211741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 14KB
SHA256 c6c7080025be0618d0d2201b38e23784d05893bf6946927c15bdb20e05a2d281
MD5 a091e5d3a7b9527cb91eb3dc1a3afddb
SHA1 f49c423f8a07241cd48162e76e9a6cc336890e28
SHA512 27b925da592f205e23106b3368fffb60b4260db20b7146106e318a4d480d728f14e34f5936f3614c11563467fec3f7e79cb0f2fae18c087e1976938a0828bdac
SSDEEP 192:1RLcBzxTnka/BNv7+p0PRpK/LPk9wHsb+WN5RD0p//Ea3wI2WgRIxcNVyIsnAUge:1RLmzBht6UXlOw5g/JqWA3e
TLSH
T10862B42BA9106A3B9CD7C329F911B797E7F5207221D41E84ABFCCA2C14E76CC211742B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 31a5ce04ae67b5403f3453ceb77ece590798531384f472283d145995727d92f5
MD5 b28f8d2c357e9f30dbd5f6faec9be3a8
SHA1 7045d97913533ca8a4d3fd4bcccacb31200659fb
SHA512 0c3fd52647169605cd7ffcc7ff7895b9d1008ecd2a828bc0aac93f78a5c3515c5bf2ae9dd7335970687bfc199d7d6444d158da461151c200b0fb87c211b0d77f
SSDEEP 384:sejIb7KxkXqKf/pUZNCgVLH2HfgslHH7pLuLcSj2XXODIX+ErU38xHG6QDzXU:suIb7KxkXqKf/pUZNCgVLH2HfgshH7pZ
TLSH
T17072F8676C489A370F94CA8CDC267B4FADB5024B65EDC86483FA581903D5BCF114A2FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 b091978d57289d132f28016e527e08311437bf950633b7781a0e2961b180593b
MD5 6adabda4635ceec9c79301554a41f4cf
SHA1 b9b6168c6dfdbaeb7507ba25fa6824826a5a9120
SHA512 e73e01463c40ba62580013ca378153bbbb143ab27d914799c3455f060e909f95b26b78c22372b710f54b3074119c11617571408385de404c190f6442e28449c0
TLSH
T141B0120080015501C8C302B431521CD8B2155F54D60A1B0193F0BA22E835561C1140A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f42a.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59f42a.TMP
Size 96B
SHA256 88378a6c08c67181df55327c539faf8bfe562ff39a104e240e0794ed6b253664
MD5 92048ba07ddf20f7c5244145c12eeba9
SHA1 ac6a00b9469fac5a7b0f02aa0563d12b3af26d5b
SHA512 c069fc345396992f0cae23d3ab3ce75e1071eb5671ddffff6fb29b5c548fd531ee9b083161f01302f474dc42e691fc1a51ea283f1ca0d11d67a10322172e56a4
TLSH
T151B0025DC2176A52C44203B4359EDADC7564DF65C603221293F02BE6DC35A718A359B4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 831fed7aa164bb25cdc0d41372c0f8e2e27834c34ac7024138422eb2d8b1c0ed
MD5 bcfd618b2efddba91207171c793d5231
SHA1 94279d08888eae952f6bef79050f6b3bda5ade61
SHA512 b92c4d4d505401b9e1d786265fb068f5a8c53b92fb31ec2fc049c034fc6f2ec2cabab7b30976b77edd854d411ad509a47be531ff8ea51956e61994c33debbfa9
TLSH
T1C7A0022441D10852CA01AA7422C21DC037244C650305E25795A09949CCF71824759685
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 115KB
SHA256 aa9682dd2d4d4425dc33a725cafca55c8095d9a4445166e1f56871697388da85
MD5 7c1feaa72271cf0e8a84e7bc7f788986
SHA1 6dcff066d0b36ce50cf41647e02023218376c625
SHA512 7d67277a893514b8f04e0635dc566e97f79fb6e57d3a8ea4690d1bf7e4465df751f5f409a76eaf52ef698bb8b071f5d9788c295c6534ecd9637f221425c3c4d1
SSDEEP 3072:rzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:vWDfxA3OnjrYQ9EU0/hEg
TLSH
T1AAC302A15C35BD660CB8EE99B44C3F60BFF4AD9A91879DC362E91B0C24FA5C81179930
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 694e6527bc5e0131073545c1c6caa902284e03f4c52ad9dd97f40909fab5d76f
MD5 ee04be356ee092afe893be1594137b3a
SHA1 abf09347eecffcf25650aa7e52ea0649a6ea24d7
SHA512 41c1e63332733a5e862ce0815f8bcc88ef53badb8c0b9949c968698b236993a20327d56aa24ce1bc9a70c0663c3462c243093b9e027306e5b6702bc5a43972c1
SSDEEP 6144:+TGvOS7mUJoOuCN5GgaoJPa7/C9tlJCe0T4THtKE+1HXlKM05:EtYmUJoOlN93JS7/CRn05X0MS
TLSH
T16F342268EE2EDBFBEB34D615F44F3E0FDE411268892181C20B66FF8D80DB2641297459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 b2c172cce0840a508eccc22ee4bfada3c414b6807e5f3115a01f60b6c2eb87e1
MD5 fe02e1d0bd8654f6a4729742c3cdfb2b
SHA1 7d7e7509cb16fa3c2cbd27f56f6c29fb6da62efa
SHA512 1bc06da3e7b111f40907e7ba774a60ded89d41e70ca3d18e6f75255c01ca5b4e858bc2ad93a1938d8f9957d40f48ce999cd7f15aceb9f827c0e57e72de8383eb
SSDEEP 6144:fTGvOS7mUJoOuCN5GgaoJPa7/C9t9vCe0T4THtKE+1HXlKM0r:7tYmUJoOlN93JS7/CZB05X0MY
TLSH
T15E342268EE2EDBEBEB34D615F44F3F0FDE411268892181C21B66FF8D80DB2641297459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 dcba2831e67d82709f35f00b48f347a692ac9bfed3486e6f697ef19f682a2d5c
MD5 c721ea6f819d4706ffcf3a20244a4a05
SHA1 3895b04bc86463c7e1f6930a9e47d6ce1733b458
SHA512 db8bfaf187c25b1a0218421662363f2939fa255960cf960a2277cf71d510632a43378b17e7c3b3afa78c25a87441b6365ba0aa6635258acbfa93f0ff86dd7fcc
SSDEEP 6144:hTGvOS7mUJoOuCN5GgaoJPa7/C9t9vCe0T4THtKE+1HXlKM0r:1tYmUJoOlN93JS7/CZB05X0MY
TLSH
T135342268EE2EDBEBEB34D615F44F3F0FDE411268892181C21B66FF8D80D7264129745A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 122KB
SHA256 a0c166d3d84e51eabf17e23e3e625315dc23748018a4cd63d3ba95a81116974b
MD5 74b508e68526da097bcf571c567d6918
SHA1 153a1872586a69e4db9518a165fabbdbcd25ac05
SHA512 cf7de80052f87240c8ea08c328eb19a38103345a3a000d133b236b4e2c37dcb3c1906846e69d3ecb16b060236b1689e8afab22cc6d049e52b465c6520d9f268a
SSDEEP 3072:LacCeiqlYoMd4ECTHQilF0rEtUF15f7LXlKuIW3ARIIr:LjCe0T4THtKE+1HXlKM0r
TLSH
T16BC312326E33EFEAD43ADA14F12F3F0F9E91738E8610A4C498797F49488754541A3A8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 234KB
SHA256 3dd586605864d5d4569f5e12fecd307ea3cd96250ced4ccc100ce7dd5b45ddcf
MD5 8f86057488d79d8c1a6de94c7e95f06e
SHA1 91da2d6562312910a4b35e720855e8e97b8a5dc2
SHA512 3d5ed4b4c307a350e6dcad822b25470a36b48cffc7f0f7bc44848250666076c932799be5e9939e331b2fba08a9868be4a805bfbfafe597796125daa1131344a9
SSDEEP 6144:dTGvOS7mUJoOuCN5GgaoJPa7/CEMCe0T4THtKE+1HXlKM0r:BtYmUJoOlN93JS7/CB05X0MY
TLSH
T1AC342279EE2EDBEAEF30D915F45F3F0FDE8102288A2181C15B16FF8944EB2641297459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 239KB
SHA256 9232282ac3ad24bef5d073111ae93acb6d023d61c8aac8cc0ae683ce509618d4
MD5 fa6badd1e61da08ec4e7b2d37d20f385
SHA1 1429fcec8d8402853d618dd39cd7b8044e105a38
SHA512 0d0377a7f5eb750242d8ef0394556bbe11f8f9a22f04b42478c19854a4d9b2ebf30f12d73937efb1c3a5cc84f84381d6be7aa18fd53d871bf617a2fd6e33adc6
SSDEEP 6144:XTGvOS7mUJoOuCN5GgaoJPa7/C9tmJCe0T4THtKE+1HXlKM05:jtYmUJoOlN93JS7/Cyn05X0MS
TLSH
T1B7342268EE2EDBFBEB34D615F44F3E0FDE411268892181C21B66FF8D80DB2641297459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 95789ba2fc44c530c5a2de5efc9123ce78a9a26a8f3da10dfbdc2c04a75ebaf0
MD5 e56587cb83c858968fd3babda59ea89c
SHA1 e4cdf1bfa56b6895d2e7cd6f594afb4bd56d727c
SHA512 f63828b86174fe4f6a94774b504f373ad35a9837a53259fa43c0d5ff589d9f2d2b26e48d865ac1d643a75241bc8d1cfc34c134ce78fdf2cc4825e462506b4797
SSDEEP 6144:0ECe0T4THtKE+1HXlKM0hWDfxA3OnjrYQ9EU0/hEt:0m05X0MHDfxjjs+Cy
TLSH
T1233412616D37FE6A4879EF24F41E3F0AEFE06B8942429CC291B93F4C08EB5851077964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 232KB
SHA256 5d71ddcf6a6af6cb585856370a9f8198058fb5d4bb2f0e4f54439448b24e4865
MD5 f2debfb0f2f49e5d880482d38940db46
SHA1 046c1d7244ffa209c0f92502c4a80809b33eac5b
SHA512 f1cc82179c60f6033629b57aae172ed61995c38caa72d41b60595825995ec932d37d6c5821b2b27cfc5d50fb33620ba52ad0f3b3f0a66c81d2c5149835b51062
SSDEEP 6144:JECe0T4THtKE+1HXlKM0hWDfxA3OnjrYQ9EU0/hEt:Jm05X0MHDfxjjs+Cy
TLSH
T1BA3412716D37FE6A4879EF24F41E3F0AEFE06B8942429CC291A93F4C08EB5851077964
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 345KB
SHA256 a9e24740f6e4d6139eb8cd94e958c14577458d3576bafe4acbc62fbfdc01826d
MD5 013974618ff8e1f3de87b10da0214f58
SHA1 6d0225086923226f6e646508098a7057087447cf
SHA512 c2a1c7e382bb8885e759263b97afd0fc62a8727ac6d3fc42240e57b945af86ab23cbd29667ddce59554f0467b7a38d3a86fdc5fa04d8e894ca91e8b6a9325698
SSDEEP 6144:mTGvOS7mUJoOuCN5GgaoJPa7/CEFCe0T4THtKE+1HXlKM0hWDfxA3OnjrYQ9EU0q:8tYmUJoOlN93JS7/Cw05X0MHDfxjjs+F
TLSH
T1E57423B0AD3AFAAA4E34ED55F40F3F1EEFD049698A1249C217657F8C04EB2A4117B464
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 240KB
SHA256 f840405aaaaae91b102b1ffcdaeacc905c0e99b6fbf83653426dc77c42030ebb
MD5 d7fbf45176d781d5853d106835a3dd40
SHA1 b4d6171b7221f45408747a03a2f76c0fe9302dee
SHA512 efbb1e8aef07fa63ef0b77563e1dc0c59a39e80f76bc1575567116e8aebe0f40fa0e5ac42fb9be9e1a461840cb41af89c650a1bddea40c8eb96961457a309db3
SSDEEP 6144:bTGvOS7mUJoOuCN5GgaoJPa7/C9tGnCe0T4THtKE+1HXlKM0r:HtYmUJoOlN93JS7/CM05X0MY
TLSH
T1EE342279EE2EDBEBEB34DA05F44F3F0FDE4112688A1181C21A26FF8940DB2741297459
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 344cb6b319c7aa5ea773fcd55c4b261cc84335e8def7b9ef0623fb9c3bc7e682
MD5 4b76b2aa88e3a9210c30358282667edc
SHA1 cb517cca432b092be4ceeba05ffb1827f68ffd67
SHA512 5029b7bb96babaaa19e394316f1c231f7949fbf3a167f89486a226913e64b07e70479c15b0b6bf65d7c380e6325d572f4bb17939ee8d728826b23933e65c2006
SSDEEP 384:7JAJkwVMa12krtuVm+bNfQOVjeQdRJot58ghNjUjTWs5PCm5z+GDa50pEuYAVHcx:N8fVMWrSldRJe6gLjUjTFHz+GDa50pEL
TLSH
T145A23B743BF51319F3B29F759AF1A95A643AB8669C00DB4D0162028D0977D92CEB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SearchHoverUnifiedTileModelCache.dat

Path C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Size 22KB
SHA256 5d988f002c0b9f1d16aff5ab7651a78cb1095965de3a0a3a01b31105bedb2fa4
MD5 83aad9ffda4682aa6d132066ce59bfa7
SHA1 d94b407f9de2285b79972186be4de91be201a407
SHA512 2672a03d3d1216fbc4543faa959683d6f3e9bc52d13096ac593c1c1238f329cce20b396be4a4dbe52aefa46db3f9da8254a91f02d9501001eaff5364f5cbffe0
SSDEEP 384:yJAJkwVMa12krtuVm+bNfQOVjeQdRJon58ghNjUjTWs5PCm5z+GDa50pEuYAVHcx:q8fVMWrSldRJg6gLjUjTFHz+GDa50pEL
TLSH
T1A6B23B743AF51319F3B29F759AF1A95A643AB8669C00DB4D0162038D0977D92CEB0F3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 d4fddbebeb932ae128e5e011deb010a6b9eb7cc17da8bb4ee0fa605fd3654094
MD5 e2d3fd6d7b72b1aae4fff298ce88ea47
SHA1 f27b37e96e028e27d9074c98ab8fb0e109c8c95a
SHA512 670c955a74760e5a1330b599e5db66fe082e61094b97f18e92422a841c696a6985ae4833d046fedc6ff277845d44c385b73733d275d45e6873a3696585c98002
TLSH
T194E0E2BE84E8404AFB58A33570D7BC84B0780E746AC39AD2C1F702746C46BDE8A251C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 b313eb4ef0ebd4253da12da5a7a5634146f864401cb32d15e5d0e04358ccc03e
MD5 949f862a9155bf9bc4f23d36bd1ee5dd
SHA1 27357b4f4c58611b9179301ba21121c229f44dfe
SHA512 9df3cbf2fb8347f0b5367809b88e9f9833630c41ff72c4a9b3015c8dcb2280e1d220adfa0480a02c14ee1366c87fe054a0bee3b963da96a66751adb31f40d91f
TLSH
T1E0E0E26E87A57D52FB48617973DAABC8B1FB0264BE839E0E41E2013868C57EC1811CC2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c97e2.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index~RFe5c97e2.TMP
Size 48B
SHA256 3365cab872de8276e61a2b3d4168e84c081de794d903289b22c9be9998155ddf
MD5 9edc57b579e7de8a0caf7600696c2dcb
SHA1 68d6031971ab32949daec64dac945607f0af4d65
SHA512 a5ea7f034216d32616f776b7e795208c5a091a6d58d020d2f2f9e316734989773aa8b166892dd82ec35d69e6952574a2ffef086f8a23cc0128e7317382a23495
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Extension Rules\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5d56dd.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State~RFe5d56dd.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
Size 188B
SHA256 ceb5d897c1e181f80f0e75eb5786626976ee8d25f5aa085d64940b8056a7480b
MD5 d91fdccb4b6c9dbb38e1fcb13f832752
SHA1 e0440ea184e5f1ffc2bbc8a5d0f9c30e0bf0ae87
SHA512 188974cb2b80b7c907a1188a00405f74acef98014e2fc18cb77ad76e9e764053bf00255c6f63018a13b08be3978b434f4345fdab6ef5ebfbf16bde09678479ab
TLSH
T17FC022B208AAB0B210A8056A6880BD085F36B230004054E88182026CB0441AA6103032
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
Size 188B
SHA256 792b09ad4172ff0ab058e67d4c92eba4b553dbbe190a6dd6628f23c536d48910
MD5 7b0a8ea8c85f810c32097915d0f83b54
SHA1 bf75ee04376aeb4f175515fd4a25d09c52288bdc
SHA512 710b02b4a041e2cfcbce0599f161721b8a0f889990efc79c9e37c3386f629e6948e8f1ae85b2217b07ca7f2e3d8affc03bdb47d853bde1e578492a2ab8ecee62
TLSH
T137C0C0A340BDF032107806292AC4BF005F36F23050C365F8C182063EE0801BFC203033
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
Size 188B
SHA256 58f75121cef7b83958afe20fcf9fd8f4fa46b7afa0b6be2b0f4042ee0543ffa8
MD5 4e64429b373345dae9e36905ae334de6
SHA1 169caf2dd33ce6c56e4b210cad5230d41a4a8052
SHA512 2aebdab88ba26286430bc7365e9de01b01d89d3daa339f3a976d0765cdb0ace78eb0e8cc1287dcdbf66628c0f2e9865d3d15c18b546e6d6ea2e41e8b8dd80de2
TLSH
T1BDC012E64579B47610F805276DD47DC55F3AB63411815CF896E246A8A06057A5603492
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
Size 188B
SHA256 9570f180d45f88daad66442bcd4a710a15ba99bbe75a99dc5e5f471f83aa7f0b
MD5 6751acd71443c25fccbbfba84da38150
SHA1 dc0c9bb34ce8af4228e1ff3e80615e9e1fe63f22
SHA512 5ab724e19227088b5d6be147526d266815a9ba874859317cd391a564f9e398a675e00b1194dfe2237c86e15654d327deba85de354a21d5fbf66f463975ad5404
TLSH
T152C022E240E9B83310A806654C84AF006F76B1380190A4F9818203BAA08016A4217013
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5ce3ff.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity~RFe5ce3ff.TMP
Size 188B
SHA256 f5140ee6b599876931893d0533b958964e9a6379e9ef083066d2107fac459445
MD5 b7e8215657f0fe412d36a0765228d93c
SHA1 8d733ec11cdd494eda1efef08a298197991c9691
SHA512 41e984f32b78ca8a28bb1d38e46a95f1e7bdc3139536f2291fc00899cf56072062c078fc3d28feeb7156c635195c25d21dbdb001e83754fbf6410f1cfb758de1
TLSH
T135C022A350AFAC7220AC052E4880BD086F76B030004068EBC282026CB00026AA103422
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
Size 8KB
SHA256 409562c9089c215fe8df33eb91bea6b0252d9f78f969a802eb9ed297392e1a84
MD5 48736ee53b61f78faf9a9ecb874e31f6
SHA1 9d7701d694536174cc69672233cdd314f1e8e610
SHA512 ee8eef07229b42a49b05c7f632ac4592aee92641320e7e9304f0e21dafdaeddca8006e94182cc85024304d72f2e4bd4608635ce83827a8f983cd2db6eff01267
SSDEEP 192:r4SX5JeWwefx7XV++UhQp4upFDkZUmbM6yIsnDjwgQ:rj2iX/U+Z7kOQ
TLSH
T15402630A6C286ABF9CCAD71DF9267A43D7F9102175D43D48E7F88A1C24D76EC222750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
Size 7KB
SHA256 a28be74f56b247d0ce5a6b2dacf1973040d3fa9cea00f2e3444fb2d00d39d038
MD5 0fb48be35f940e3846cdec568b193bf3
SHA1 96ce0f97506c078c7768b96c5042cf86e6548e85
SHA512 772d55ed965ace77f36595a9d1fb6f497d01c015af051b82dc637a5668c8f159dcf1930cb9aafbda55e7a2b8943720c59cd5abe84cdeff8e701103d1001f6b5a
SSDEEP 192:r4SX5JeWwefx7XV++wp4upFDk4UVPM6yIsnDjwgQ:rj2iX/wZ7k8Q
TLSH
T10FF1740A6C18AABF5CC6D31DF9267A43D7F9102175943D48E7F8CA1C24D76EC222791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
Size 8KB
SHA256 c9a8b6bdea505cba316feb12782a514130b37be787693d0c6c24609eeebd7b76
MD5 1367c4f3f1eab52d810568501655e15d
SHA1 f297ac3dc6e4c701cc613b56022917ff74cd6126
SHA512 5f8fe61ead2c2a5437735e210f3673163c4636ba4fb31d4c843cdf3ee2db69b35bfa62984404afd526bcf1443af649a785313b392fa365fd428cef2719de165d
SSDEEP 192:r4SX5JePwefxEXV++UhQpgpi5EpUgPM6yIsnDjwgQ:rj2KX/U+SCEQQ
TLSH
T1CC02740A5C546ABF9CC6D71DFA26BB42D7F9102276D03D48E7F88A1C24D76DC222750B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5ca09d.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences~RFe5ca09d.TMP
Size 7KB
SHA256 ffdf4e342632bc8bf866527d10601fb0ae2955990be44879b180919766f807de
MD5 5dae376f83cbbc5330ce54abe26ece59
SHA1 937babd2bac92f38be1370d730b1da291140e74a
SHA512 b46d0b5781b0a60df3afeec31e6bd845f9a8e52d938cc92d75a1c7ab62ee126ee02ab1cd8007c02ef7073ffc33228290383509837aca96a6c30b29c7287b951f
SSDEEP 192:r4SX5JeW5efx7XV++wp4upFDk4UVPM6yIsnDjwgQ:rj2lX/wZ7k8Q
TLSH
T18DF1740A6C18AABF5CC6D31DF9267A43D7F9102175943D48E7F8CA1C24D76EC222780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 2KB
SHA256 539459c1262f7bf000dfd85971661714bddb5dee21f4812fc5b0858baeec1f80
MD5 141b27331e4a0360515fd4ad562d8f64
SHA1 74ba04f1611564124637a4384f1c5762f6fda1ad
SHA512 7b574d7b42f87dcc723eb8d492d6708e5c48ad423078aa1edc5c917b353b4d87b14de7de48477ad6f29577257479fa18a6af2d1d8b005c872ee795bbbb589111
TLSH
T138519832B4A88D739677C455F506BE03DEB86165A1605BA4F1ED4B0C01D7DEC135382B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 2KB
SHA256 1d4fb8f28009b1c39a7721f4fb789db346340c8aba4c6a5a60676b8ed1aca65a
MD5 14b638561fe4d51ecec85b218f0b8891
SHA1 21fb3623c94dcaa1ab7017119c1b3851684f12a8
SHA512 2f4b13c5f5c6ce22bd9740db8712765d05eddd15d10978b242a7dff3a6003bcc52572d90d74273ea8e3ac363decdd52ac0a8ad20b332b3d69d5d8ca9f2b06bbd
TLSH
T106518632A4A889735677C455F506BE03DEB86165A5606B94F1DE0B0C01D7DEC135382B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 2KB
SHA256 66b57fec30497f396078f6edfc915011e81f9df683d4c366b5b993e4c8d466d4
MD5 1f7ca3260ab8647cdf8bc021ec8c47e9
SHA1 987cc4c7ef1092a4612f9a5bd27bdebff2443022
SHA512 9c83cd564cbcad56de601a6ffbef16d79af7a025d8a6900d1062233e400279dd13010086a1565bc72ecf4c39951e102c25a24fe4641f5f61f696bf03793942d0
TLSH
T110518732A4B88D739677D455F906BE03DEB86166A2606BA4F1EE4B0C01D7DEC135382B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 2KB
SHA256 cfb2d227f678297836e8b0346c05962bb66ec85fe5aa61c383a52c8f2a54c691
MD5 90a6467a2eda0160576a79a3f1d09c99
SHA1 3f4b32b7a335525398314a9966c806818d7a65cd
SHA512 bd347bdf04ce1b6836d24f55fc6988927946986b856935de94aee50adcec769a89cbd68d79b41c392066c018b036e0d599dea48777f2492d443270572ed264e7
TLSH
T107519732A4B88D7395B7D455F5067E03DAB86166A1A05B94F1EE0F0C01D7DEC135382B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 2KB
SHA256 65bd05801bf906e2b7b64cdf7ae7463d1ca2084bce30f5cc6e3cd0a13830c499
MD5 8ff3799c415923b9cca2e89d2ec32bb1
SHA1 acd7e61ec06e416968c49124d5e783c3f474a30f
SHA512 c0619dce2fb57518cb9610c0fc919f39d8ea4e36868836f9a8a674704c8b0d108cfea72e30266fd3036acbf8dd85fadf963231d14cd042b2414082ad0b2ff5a6
TLSH
T125519832B4B88D739677C455F906BE03DEB86166A6606BA4F1EE4B0C01D7DEC135382B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 1KB
SHA256 f71924f6fdbc8586e7935c3e9a34af58d83b945e0a56be12649337003752967d
MD5 cbe4accb019f8f143d68d298aa32731f
SHA1 03d98e2b9f44fa66434bd06769ad5f262039f330
SHA512 39351e32ebe92287500762c168c2d7328976d02bab0d1f8b77c89f1d79ac3ebed760a7efdac039908830fafff99b27c0e007a7b6f1eef0317b6b42e4585df0ad
TLSH
T18D116533F4B84B62AA67892AB605EE032E31516640244B8CB1DE171901D7DDD5737C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5c302f.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State~RFe5c302f.TMP
Size 890B
SHA256 17e3a9cbde0b85bae97320b68cb3892804a44c5118b71b54fbc67dbff5627e66
MD5 cc19313d99439aa9eb2b0af0ffdd131f
SHA1 b1125b91ddfb27f65d654821459729bfff351e46
SHA512 0bfb54e2f9d7406b1ff4de93811737d67208db3ba939fe01db24222c62233111b2fbd0cab8af60f4f9f2559e9a20dfa2a6813b52c65b397a5766b0e36e2a01dd
TLSH
T1E2115633F4940B616E634429B545EE032D34555A81240B5CB1DE130500E7DDD9637C3E
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_jtl2x2ol.hjo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_jtl2x2ol.hjo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nscFBF3.tmp\System.dll
Size 12KB
SHA256 9d81c2e901e59350e33f0c33f44e033e727a4d962e245ecb23561da8feccdfad
MD5 67fc1324e53b1f3854557f23b0c22654
SHA1 d36528a0468951a90a67a8e71881eee655d65c7c
SHA512 0fe91fd5e2267c3f21712f0a921539a13868e57e0f5444d86704a3e3ca15e383130ece5433ff9948e8772c777c401270ccfa99eab65527039333946ff662f4e4
SSDEEP 192:K5zfH361apH705aW7DSGb6KVFEc+Js68XDEKjbR493oJZnxxYCBm9:K5zfX61apHg5a+SIJFESACGISCm9
TLSH
T1D4424B5AEB72207BD01385BD9795E107D335B8DA79E0974F0AE8AA3A2F137902C5434E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nscFBF3.tmp\nsExec.dll
Size 6KB
SHA256 a22e9b6a0d511872cd572fe5758026a26e90ee3f19fa992a02abe4f6d34f5535
MD5 cf0cac49c427a501d7806033941a6da1
SHA1 92acf906cc962b7e4c4138aac8ecec67c9629b4a
SHA512 7ad31611d7c0657d70318c16c781b7da793c8a19e4dfafcc90abcd4c8eb0dbad3aacf643b558b573502e50f504bb9f384b4df95f0db840e68763f03a7d8e85d6
SSDEEP 96:wC66T7ItPQcwPbfTA3Ck3lKYHxFYSdt4RTUR+4nz:dT7+EEjje4
TLSH
T15CD1CA2AA7C102A8C82F51F0A93F4A07EBA5308125785A3F2A688C0E4F53AF1737C745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg50E2.tmp\System.dll
Size 22KB
SHA256 fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0
MD5 a36fbe922ffac9cd85a845d7a813f391
SHA1 f656a613a723cc1b449034d73551b4fcdf0dcf1a
SHA512 1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b
SSDEEP 384:V8QIl975eXqlWBrz7YLOlE/NyQH38E9VF6IYinAM+oZ5a1TN:VgPgrfYLO+rMEpYinAMxZG
TLSH
T198B29D6346105CB2DD478834B4C9B936AF7536439AE0CAD39396C1119F607C37EBC267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsg50E2.tmp\modern-wizard.bmp
Size 150KB
SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
MD5 3614a4be6b610f1daf6c801574f161fe
SHA1 6edee98c0084a94caa1fe0124b4c19f42b4e7de6
SHA512 06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281
SSDEEP 48:ZQEM+jeAwtwVUoYxq+HQiNE/7o+f3cbqBtpozK8lHl/GGKOFHNPf33zFYsvwL:ZkWeftwV1enu/7ozCeu8RGGvP/jFYsv
TLSH
T1F8E3E9AEB933693ECD9911B41164A7FD8B306C5C7A40666E411FF8DC0FF31CA3569852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg50E2.tmp\nsDialogs.dll
Size 20KB
SHA256 91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0
MD5 4e5bc4458afa770636f2806ee0a1e999
SHA1 76dcc64af867526f776ab9225e7f4fe076487765
SHA512 b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162
SSDEEP 384:ABSzm+t18pZ0WAg0RhIFgnGNyQH38E9VF6IYinAM+oZfNRoZk:NupZ/Ag0/T8MEpYinAMxZ7oW
TLSH
T11EA26CA385542C33CE874E3635D8653EDBB9731664808CC25326C24197A439B7FB83AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg50E2.tmp\nsExec.dll
Size 17KB
SHA256 3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226
MD5 2095af18c696968208315d4328a2b7fe
SHA1 b1b0e70c03724b2941e92c5098cc1fc0f2b51568
SHA512 60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5
SSDEEP 384:PbGgezxEqoyGgmkNFNyQH38E9VF6IYinAM+oZhc3iMy8:T31yGLkbMEpYinAMxZAy8
TLSH
T1DE826CB749802C66CD4F8D7039D4A83A5BB9BA531BE0C1D2535BC2518B917C2FFE82A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsg50E2.tmp\nsProcess.dll
Size 15KB
SHA256 bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8
MD5 08072dc900ca0626e8c079b2c5bcfcf3
SHA1 35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37
SHA512 8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c
SSDEEP 192:WUl64IGsjDNyQDbnPvy2sE9jBF6IYiYF8pA5K+oZ7W76OCwy9GUe:5ZsNyQH38E9VF6IYinAM+oZYsBe
TLSH
T1E0726BB38A582C21DE4B4D3171D4853AAEB9AA571AC0C1D3634BC1518BC1BC7BBF82F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 10KB
SHA256 b237c8646182e955cf93e53b1eacf972ef39b8100c62edc22eac18107fe13b4c
MD5 210846348d924c6682b04f6267f9d60e
SHA1 ee67de14062b3c1bbfe4b1ecb724c9981b8323ad
SHA512 acc2576c75d43a1c719a911d775951c176d66dddb256f48096f225e0065b39eb53c415aec2b080b39fc643bc1c445f0d9e38827894957d9cb4906febf42e4c66
SSDEEP 96:0lQJa6FuLWlQh92FCO2lQQP5Fa2SlQ+GlQgsZ:8QiuQhYOQQutQtQT
TLSH
T1FD22F0417BF9665AF2F3DA75B9B327115F7AF902CA189D0E418093090DA2F005AA8F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 10KB
SHA256 3c0a2cff0cfcb19fbb0642c4a3270db5f0cc1f574ef58a27351f07644963e8c6
MD5 a8de9d2433e3cdaf43de2e2368c49bd1
SHA1 ffd8fdd2a1b173ca61e0f9a64d21e53243e7f637
SHA512 4ab948a8d5c5bf438bead87b31bb7bce5420542d6a67785f037d1b5066c3a0d6a9a42e7ca8842fab97da76293630548accbb783b7c617aefddf9dacd1ac60a01
SSDEEP 96:Ilhh92FCOelQQP5Fa2XlQJa6FuLLlQ+WlQgsZ:IhhYWQQuaQiBQVQT
TLSH
T18922EE413BFA6656F2F3CA75B9B327115F7AF902CA189D1E418093090CA2F005AA8F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d696d521de238c3.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\5d696d521de238c3.customDestinations-ms
Size 10KB
SHA256 e87def6a79640a9fd0995f802cb68096181360184dddb53934dbb8d7f7d0c30d
MD5 f50a628723243a8458e2636bdf92ba78
SHA1 5de11addedeaebe8edda116ed11a7c9dbae06b6e
SHA512 d27d2fb39d4a4213008384bee6e0e608adb1c9f96215a78ea6764c3285a1766b8411d00043234fa9b85195ce89b264f9e37d600b38cf196f8390bf4aaecf5142
SSDEEP 96:blQQP5Fa20lQJa6FuLRlQh92FCOolQ+plQgsZ:xQQuTQivQhYoQsQT
TLSH
T1D322EE413BFA665AF2F3DA75B9B727115F3AF902CA189D1E418093090CA1F005AA8F77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamSetup.exe:Zone.Identifier

Path C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier
Size 147B
SHA256 f3340a0498a1387b2e127b112d6c5301fc8701aa5ba7f0948e34b2875b277702
MD5 6fac30c6aeb8579559e615cab61c553e
SHA1 ccaac9d9a91496a2ff6d94272e67ccf853e5d6f8
SHA512 10637368708137544065ef625c968ebcdfab6c4fbe63515eb5f40009a7fa45f596c46905d26442d43dc6419207fb73d8a3599e40cf41a2c755a068e724fe3103
TLSH
T113C02BEB4504843C0F0453D838DFC55EB64F704A18185590FCC0429BDC05550C36D107
MD5 SHA1 SHA512 TLSH

Submit Download

Unconfirmed 174117.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 174117.crdownload
Size 10.6MB
SHA256 41ec92bc311daf40b22b2497d044b12d9ba0266da84d8581255d7cc9e059135f
MD5 54cceb7c9c0c50a9d2f0b1b4f173eb33
SHA1 ffc28139e6c2d2eeeb27bc39f2ab20e4b8b4c08e
SHA512 41a589e7ea52d1a8730a4f12ef3db6e5738cb426f38483e8dc178e42d3ef58e1459cc61cccab800891f38fc9e6e3eccc76c46c2782108d084d91234b1f43b53d
SSDEEP 196608:CW3Cqh6Vk9faCb3TiZEZmpJh+k4tlrP8Kl6n6D0MhCWuhfdeU7YD:7CDQaC28nl78Kg6zCWCdFs
TLSH
T1C0B633942474E24DE0BA0031EC61EF66DDF4B09A5B058A1E4299CB6577E4BE34C2FECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 33228.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 33228.crdownload
Size 2.3MB
SHA256 7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb
MD5 1b54b70beef8eb240db31718e8f7eb5d
SHA1 da5995070737ec655824c92622333c489eb6bce4
SHA512 fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb
SSDEEP 49152:UDP/q9MIX/crfcNVBaXp1m0zyVCMwBHgFzoZhRP8:kC9MI8Hm0GCjgFc3Rk
TLSH
T11FB533116FB8D076DAE20F71E0FA86F79536FC15962A4F4B3A807B2F7835110A5047B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2668-13877-0x00007FF887600000-0x00007FF887601000-memory.dmp

Download

memory/2668-13878-0x00007FF886230000-0x00007FF886231000-memory.dmp

Download

memory/3024-13805-0x0000000000530000-0x0000000000A39000-memory.dmp

Download

memory/4840-7212-0x0000000000A90000-0x0000000000F42000-memory.dmp

Download

memory/5068-611-0x000001FA0EC70000-0x000001FA0F32B000-memory.dmp

Download

memory/5068-2139-0x000001FA0EC70000-0x000001FA0F32B000-memory.dmp

Download

memory/5068-932-0x000001FA0EC70000-0x000001FA0F32B000-memory.dmp

Download

memory/5068-45-0x000001FA0EC70000-0x000001FA0F32B000-memory.dmp

Download

memory/5068-957-0x000001FA0EC70000-0x000001FA0F32B000-memory.dmp

Download

memory/5068-1687-0x000001FA0EC70000-0x000001FA0F32B000-memory.dmp

Download

memory/5068-0-0x00007FF867960000-0x00007FF867EA1000-memory.dmp

Download

memory/5068-9-0x000001FA0EC70000-0x000001FA0F32B000-memory.dmp

Download

memory/5068-8-0x000001FA0EC70000-0x000001FA0F32B000-memory.dmp

Download

memory/5068-7-0x000001FA0EC70000-0x000001FA0F32B000-memory.dmp

Download

memory/5068-4-0x000001FA0EC70000-0x000001FA0F32B000-memory.dmp

Download

memory/5068-2-0x000001FA0EC70000-0x000001FA0F32B000-memory.dmp

Download

memory/5068-1-0x000001FA0F3A0000-0x000001FA0F3B0000-memory.dmp

Download

memory/8536-15108-0x000002187A200000-0x000002187A602000-memory.dmp

Download

memory/8536-15310-0x000002187A200000-0x000002187A602000-memory.dmp

Download

memory/8536-15160-0x0000021877DA0000-0x0000021878FD3000-memory.dmp

Download

memory/8536-15107-0x0000021877DA0000-0x0000021878FD3000-memory.dmp

Download

memory/8536-15161-0x000002187A200000-0x000002187A602000-memory.dmp

Download

memory/8536-15430-0x000002187A200000-0x000002187A602000-memory.dmp

Download

memory/8536-15232-0x000002187A200000-0x000002187A602000-memory.dmp

Download

memory/8536-15231-0x0000021877DA0000-0x0000021878FD3000-memory.dmp

Download

memory/8536-14902-0x0000000180000000-0x00000001801E2000-memory.dmp

Download

memory/8536-15265-0x000002187A200000-0x000002187A602000-memory.dmp

Download

memory/8536-15264-0x0000021877DA0000-0x0000021878FD3000-memory.dmp

Download

memory/8536-15039-0x0000021877DA0000-0x0000021878FD3000-memory.dmp

Download

memory/8536-15040-0x000002187A200000-0x000002187A602000-memory.dmp

Download

memory/8536-15429-0x0000021877DA0000-0x0000021878FD3000-memory.dmp

Download

memory/8536-15309-0x0000021877DA0000-0x0000021878FD3000-memory.dmp

Download

memory/8536-14982-0x000002187A200000-0x000002187A602000-memory.dmp

Download

memory/8536-14981-0x0000021877DA0000-0x0000021878FD3000-memory.dmp

Download

memory/11608-14581-0x00007FF842840000-0x00007FF842D81000-memory.dmp

Download

memory/13500-14480-0x0000027762A30000-0x0000027762A4C000-memory.dmp

Download

memory/13500-14481-0x0000027762A50000-0x0000027762B03000-memory.dmp

Download

memory/13500-14488-0x0000027762B70000-0x0000027762B7A000-memory.dmp

Download

memory/13500-14473-0x0000027762C00000-0x0000027762DC2000-memory.dmp

Download

memory/13500-14482-0x0000027762550000-0x000002776255A000-memory.dmp

Download

memory/13500-14483-0x0000027762B30000-0x0000027762B4C000-memory.dmp

Download

memory/13500-14484-0x0000027762570000-0x000002776257A000-memory.dmp

Download

memory/13500-14463-0x00000277628E0000-0x0000027762926000-memory.dmp

Download

memory/13500-14485-0x0000027762B50000-0x0000027762B6A000-memory.dmp

Download

memory/13500-14486-0x0000027762B10000-0x0000027762B18000-memory.dmp

Download

memory/13500-14455-0x00000277624A0000-0x00000277624C2000-memory.dmp

Download

memory/13500-14487-0x0000027762B20000-0x0000027762B26000-memory.dmp

Download

memory/19248-14502-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14301-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14516-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14256-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14254-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14678-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14681-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14143-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14229-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14228-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14211-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14462-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14303-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14427-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14274-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14257-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14361-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14302-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14328-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/19248-14312-0x000001C9858C0000-0x000001C986AF3000-memory.dmp

Download

memory/21200-14326-0x000001BBB3AA0000-0x000001BBB3AA1000-memory.dmp

Download

memory/21200-14323-0x000001BBB3AA0000-0x000001BBB3AA1000-memory.dmp

Download

memory/21200-14324-0x000001BBB3AA0000-0x000001BBB3AA1000-memory.dmp

Download

memory/21200-14325-0x000001BBB3AA0000-0x000001BBB3AA1000-memory.dmp

Download

memory/21200-14322-0x000001BBB3AA0000-0x000001BBB3AA1000-memory.dmp

Download

memory/21200-14320-0x000001BBB3AA0000-0x000001BBB3AA1000-memory.dmp

Download

memory/21200-14315-0x000001BBB3AA0000-0x000001BBB3AA1000-memory.dmp

Download

memory/21200-14316-0x000001BBB3AA0000-0x000001BBB3AA1000-memory.dmp

Download

memory/21200-14314-0x000001BBB3AA0000-0x000001BBB3AA1000-memory.dmp

Download

memory/21200-14321-0x000001BBB3AA0000-0x000001BBB3AA1000-memory.dmp

Download