b27905e17203e0e343ec2e3d6b5cd34105b42027ad6bfd1242e4c299d41e663c

Analysis

user interaction
yes
max time kernel
75s
max time network
254s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 16:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
hrx.exe
Size 383KB
Sample260908-t867fseq71
SHA256 b27905e17203e0e343ec2e3d6b5cd34105b42027ad6bfd1242e4c299d41e663c
MD5 863b5af0695b74d7c79ea5433b4773a5
SHA1 02cc42f823530931f7488ebee211ce70e40c6d39
SHA512 65428a4da61d5975364b1f343e0cdcf3ee8f7ce7ce3d67e1b37d4d5740ea847ddea4c0997243191307fd182b3793e8de6360c322a553e7148287c4be3c23d9ec
SSDEEP 6144:SQzqgXdmgYUvlNy7YqFWr7BtCWhs2iJyso+6QS9kgRPkm18KnY:xdy7Y3tCWe2K++6h9kgRPSK
TLSH
T148849D15F7A514F9E2778134C9626507DB723C8E07A0EACB13A88F961F336D09E7A712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery persistence ransomware spyware trojan

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
238	1140	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
1528	SteamSetup.exe
6748	steamservice.exe
7024	Steam.exe
7136	steamservice.exe

Loads dropped DLL 7 IoCs

pid	Process
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -silent"	SteamSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 56 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_korean.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\package\steamui_websrc_sounds_all.zip.vz.5ba6acd8f4dfe4b93437895b20344fab5bb3ff96_3714779	Steam.exe
File created	C:\Program Files (x86)\Steam\package\steamui_websrc_movies_all.zip.f556f4b9c7e087e07c0fef2da2b1d9f27f734cff	Steam.exe
File created	C:\Program Files (x86)\Steam\Steam.exe	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt	SteamSetup.exe
File opened for modification	C:\Program Files (x86)\Steam\logs\bootstrap_log.txt	Steam.exe
File created	C:\Program Files (x86)\Steam\logs\bootstrap_log.txt	Steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Common Files\Steam\steamservice.exe	steamservice.exe
File created	C:\Program Files (x86)\Steam\package\bins_hardware_all.zip.vz.306ae066fe4956d11ac55b1ef54f2decf827df44_268398	Steam.exe
File created	C:\Program Files (x86)\Steam\package\steam_win32_steamrow.zip.vz.bbc936b85d699fd5a58f846502da312446c5c690_1884139	Steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\package\resources_misc_all.zip.vz.e86a975545f3ab21a77373870cb311ef93934b8c_2224876	Steam.exe
File created	C:\Program Files (x86)\Steam\package\strings_all.zip.vz.c8734726f00a425eca473282cbd933f4c0f13a00_2015332	Steam.exe
File created	C:\Program Files (x86)\Steam\package\bins_codecs_win32.zip.vz.d9d8ef26467ee44cc445b1d78216580fdc6b2c84_6136735	Steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\uninstall.exe	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\package\strings_en_all.zip.8eef428d222948911a09e2ceb6e5e8a7225b3447	Steam.exe
File created	C:\Program Files (x86)\Steam\package\public_all.zip.vz.48a9a991c3ce62641e0705c48fd483b4587d09cc_23753492	Steam.exe
File created	C:\Program Files (x86)\Steam\package\bins_hardware_win32.zip.5761afacd4ecada95f3b6c780bd881b46edb2f34	Steam.exe
File created	C:\Program Files (x86)\Steam\package\bins_win64_win32.zip.vz.f1e8aff3b2a8672382ad817491e7dd633eefcb4d_5004865	Steam.exe
File created	C:\Program Files (x86)\Steam\package\bins_webhelpers_win32_win7-64.zip.vz.36920971a7f411394bb3e017c6df811f0fd4dabd_3585052	Steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_indonesian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\.writable	Steam.exe
File opened for modification	C:\Program Files (x86)\Steam\.crash	Steam.exe
File created	C:\Program Files (x86)\Steam\package\tenfoot_images_all.zip.vz.193cb8c4eb4446698ea2c0a9e8c4e6b6a623dac7_5572671	Steam.exe
File created	C:\Program Files (x86)\Steam\package\resources_all.zip.vz.3c8b3203e5c69d75ea0684c2409b86fe4d0d6f83_2856188	Steam.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt	SteamSetup.exe
File created	C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt	SteamSetup.exe
File opened for modification	C:\Program Files (x86)\Common Files\Steam\service_log.txt	steamservice.exe
File created	C:\Program Files (x86)\Steam\package\resources_hidpi_all.zip.vz.3de815c3117712cb9eeb7ea4c8b275faf481dcfd_56342	Steam.exe
File created	C:\Program Files (x86)\Steam\package\bins_misc_win32.zip.vz.825801daade33a37975c094c79ce2958eb41fd6a_11881906	Steam.exe
File created	C:\Program Files (x86)\Steam\package\steamui_websrc_all.zip.vz.3454fedc48870f10019f5c5707aa34b9445f8fce_25053126	Steam.exe
File created	C:\Program Files (x86)\Steam\bin\SteamService.exe	SteamSetup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 2 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c61900000001000000100000002fe1f70bb05d7c92335bc5e05b984da6030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f6314000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e20000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Steam.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c00000001000000040000000010000014000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e0f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e81900000001000000100000002fe1f70bb05d7c92335bc5e05b984da66b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	Steam.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SteamSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Steam.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	steamservice.exe

System Time Discovery 1 TTPs 3 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4816	steamwebhelper.exe
1140	msedge.exe
4780	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Steam.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Steam.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134333595166418340"	msedge.exe

Modifies registry class 43 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\steam\Shell	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\steamlink\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\URL Protocol	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\steam\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\steamlink\URL Protocol	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\steamlink\Shell	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\steam\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\steamlink\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\ = "URL:steam protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\Shell\Open\Command\ = "\"C:\\Program Files (x86)\\Steam\\steam.exe\" -- \"%1\""	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\DefaultIcon\ = "steam.exe"	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\Shell\Open\Command	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steam\Shell\Open\Command	steamservice.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\ = "URL:steamlink protocol"	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\steamlink\DefaultIcon	steamservice.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\steam\URL Protocol	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{567DF787-3021-42BC-AA57-26460105ECD1}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steam	steamservice.exe
Key created	\REGISTRY\MACHINE\Software\Classes\steamlink\DefaultIcon	steamservice.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\steamlink\Shell\Open	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\steam	steamservice.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\steam\Shell\Open\Command	steamservice.exe

Modifies system certificate store 2 TTPs 1 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	Steam.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
5676	hrx.exe
5676	hrx.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe
1528	SteamSetup.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	6748	steamservice.exe
Token: SeSecurityPrivilege	6748	steamservice.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 468	2728	msedge.exe	91
PID 2728 wrote to memory of 1140	2728	msedge.exe	92
PID 2728 wrote to memory of 1220	2728	msedge.exe	93
PID 2728 wrote to memory of 1220	2728	msedge.exe	93
PID 2728 wrote to memory of 1220	2728	msedge.exe	93
PID 2728 wrote to memory of 5380	2728	msedge.exe	94
PID 2728 wrote to memory of 5380	2728	msedge.exe	94
PID 2728 wrote to memory of 4500	2728	msedge.exe	96
PID 2728 wrote to memory of 4500	2728	msedge.exe	96
PID 2728 wrote to memory of 4500	2728	msedge.exe	96
PID 2728 wrote to memory of 4944	2728	msedge.exe	97
PID 2728 wrote to memory of 4944	2728	msedge.exe	97
PID 2728 wrote to memory of 4944	2728	msedge.exe	97
PID 2728 wrote to memory of 1168	2728	msedge.exe	98
PID 2728 wrote to memory of 3284	2728	msedge.exe	99
PID 2728 wrote to memory of 1168	2728	msedge.exe	98
PID 2728 wrote to memory of 1168	2728	msedge.exe	98
PID 2728 wrote to memory of 3284	2728	msedge.exe	99
PID 2728 wrote to memory of 3284	2728	msedge.exe	99
PID 2728 wrote to memory of 3828	2728	msedge.exe	100
PID 2728 wrote to memory of 3828	2728	msedge.exe	100
PID 2728 wrote to memory of 4844	2728	msedge.exe	102
PID 2728 wrote to memory of 4844	2728	msedge.exe	102
PID 2728 wrote to memory of 4952	2728	msedge.exe	103
PID 2728 wrote to memory of 4952	2728	msedge.exe	103
PID 2728 wrote to memory of 580	2728	msedge.exe	104
PID 2728 wrote to memory of 580	2728	msedge.exe	104
PID 2728 wrote to memory of 732	2728	msedge.exe	105
PID 2728 wrote to memory of 732	2728	msedge.exe	105
PID 2728 wrote to memory of 732	2728	msedge.exe	105
PID 2728 wrote to memory of 2708	2728	msedge.exe	107
PID 2728 wrote to memory of 2028	2728	msedge.exe	110
PID 2728 wrote to memory of 3904	2728	msedge.exe	111
PID 2728 wrote to memory of 5116	2728	msedge.exe	112
PID 2728 wrote to memory of 2028	2728	msedge.exe	110
PID 2728 wrote to memory of 2028	2728	msedge.exe	110
PID 2728 wrote to memory of 3904	2728	msedge.exe	111
PID 2728 wrote to memory of 3904	2728	msedge.exe	111
PID 2728 wrote to memory of 5116	2728	msedge.exe	112
PID 2728 wrote to memory of 3272	2728	msedge.exe	113
PID 2728 wrote to memory of 3272	2728	msedge.exe	113
PID 2728 wrote to memory of 6032	2728	msedge.exe	114
PID 2728 wrote to memory of 6032	2728	msedge.exe	114
PID 2728 wrote to memory of 6032	2728	msedge.exe	114
PID 2728 wrote to memory of 1780	2728	msedge.exe	115
PID 2728 wrote to memory of 1780	2728	msedge.exe	115
PID 2728 wrote to memory of 1780	2728	msedge.exe	115
PID 2728 wrote to memory of 3048	2728	msedge.exe	117
PID 2728 wrote to memory of 3048	2728	msedge.exe	117
PID 2728 wrote to memory of 3048	2728	msedge.exe	117
PID 2728 wrote to memory of 1636	2728	msedge.exe	118
PID 2728 wrote to memory of 4492	2728	msedge.exe	119
PID 2728 wrote to memory of 5760	2728	msedge.exe	120
PID 2728 wrote to memory of 4492	2728	msedge.exe	119
PID 2728 wrote to memory of 4492	2728	msedge.exe	119
PID 2728 wrote to memory of 2228	2728	msedge.exe	121
PID 2728 wrote to memory of 5760	2728	msedge.exe	120
PID 2728 wrote to memory of 2228	2728	msedge.exe	121
PID 2728 wrote to memory of 1528	2728	msedge.exe	122
PID 2728 wrote to memory of 6308	2728	msedge.exe	123
PID 2728 wrote to memory of 6316	2728	msedge.exe	124
PID 2728 wrote to memory of 6324	2728	msedge.exe	125
PID 1528 wrote to memory of 6748	1528	SteamSetup.exe	126
PID 2728 wrote to memory of 4696	2728	msedge.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\hrx.exe
"C:\Users\Admin\AppData\Local\Temp\hrx.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2ec,0x304,0x7ffcf54cc188,0x7ffcf54cc194,0x7ffcf54cc1a0
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2176,i,2806691903063157029,907988827234682576,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1908,i,408958386071812411,12338834704858849582,262144 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:2
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2648,i,3946222656782873529,1487748817204982956,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:13
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,14232835838955792812,2836096695083795826,2097152 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=3844 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,4125029595281922384,9919952099831106099,2097152 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,17092074303159658685,10343097142512101457,2097152 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:9
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,2866562374929006796,15608197822454266935,2097152 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,11604397948660701706,4414933082550474320,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,5748264779760795481,15285193598774990715,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,5248622280562144958,6825607349214009535,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:14
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,2294787428472154666,3980876676894509785,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
  2⤵
  PID:580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6096,i,647930171914563295,948858163592547762,2097152 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,11642792360388938690,8120511847481973454,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,11642792360388938690,8120511847481973454,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6656,i,6072058225837217158,12578925634308722638,2097152 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6748,i,17422732156139782994,430659653671129028,2097152 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6856,i,14213232614736681783,8076374876889690178,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,13548975422063627723,17122156470152907244,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:14
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6176,i,2903376058918198508,5890007443274076663,2097152 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7156,i,12863890570397448820,13059722261441655767,2097152 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4808,i,2348551758123708287,4443659621400544731,2097152 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4796,i,1400530191028153344,9332971870450364890,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:14
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4184,i,15584497909621699684,3962815257313726987,2097152 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7564,i,7134125491712432861,2181819736123703883,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7772,i,17761491697652143929,12455727453135281344,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=7648 /prefetch:14
  2⤵
  PID:2228
- C:\Users\Admin\Downloads\SteamSetup.exe
  "C:\Users\Admin\Downloads\SteamSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Program Files (x86)\Steam\bin\steamservice.exe
    "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:6748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1284,i,10216575944552318322,11186890536161041024,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:14
  2⤵
  PID:6308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,17642804824020025950,3207789952255411757,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=1392 /prefetch:14
  2⤵
  PID:6316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1292,i,8835422847765112452,580533825125060199,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:14
  2⤵
  PID:6324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,4887429161774209878,8976893352055222976,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:14
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7284,i,8621850088431777449,17390851555449668951,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=7948 /prefetch:14
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6524,i,14270834812924998999,17724815952088032679,262144 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=7936 /prefetch:10
  2⤵
  PID:6956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,1804831870839273306,8825131562132081017,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:14
  2⤵
  PID:6696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,17822845108767096480,7770592363373460381,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:14
  2⤵
  PID:6616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6304,i,16491591749016813628,9931641335397214202,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:14
  2⤵
  PID:6852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7936,i,4371126774072254350,12441894392812799784,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=7976 /prefetch:14
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,6796539887101190100,17617400421996116096,524288 --field-trial-handle=2580,i,14737420170196878102,13858371550143027792,262144 --variations-seed-version --mojo-platform-channel-handle=7800 /prefetch:14
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
  2⤵
  PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffcf54cc188,0x7ffcf54cc194,0x7ffcf54cc1a0
    3⤵
    PID:5768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,17789245827026621856,16655596129211116107,524288 --field-trial-handle=2028,i,8305648128807755765,2869275628715789013,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,11379131991057380756,1234574817466595204,262144 --field-trial-handle=2028,i,8305648128807755765,2869275628715789013,262144 --variations-seed-version --mojo-platform-channel-handle=1900 /prefetch:2
    3⤵
    PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,13162173100214655519,15960193742166592015,524288 --field-trial-handle=2028,i,8305648128807755765,2869275628715789013,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:13
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,9669940828143177526,11868965101769853879,524288 --field-trial-handle=2028,i,8305648128807755765,2869275628715789013,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,9669940828143177526,11868965101769853879,524288 --field-trial-handle=2028,i,8305648128807755765,2869275628715789013,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,15653374365615727160,5184640483633458309,524288 --field-trial-handle=2028,i,8305648128807755765,2869275628715789013,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:14
    3⤵
    PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,9344106661524598854,16326585900074899651,524288 --field-trial-handle=2028,i,8305648128807755765,2869275628715789013,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:14
    3⤵
    PID:7028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,7595307516286673456,12237331491372026536,524288 --field-trial-handle=2028,i,8305648128807755765,2869275628715789013,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:14
    3⤵
    PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5816

C:\Program Files (x86)\Steam\Steam.exe
"C:\Program Files (x86)\Steam\steam.exe" -silent
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies trusted root certificate store through registry
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies system certificate store
PID:7024
- C:\Program Files (x86)\Steam\Steam.exe
  "C:\Program Files (x86)\Steam\Steam.exe" -silent
  2⤵
  PID:3336

C:\Program Files (x86)\Common Files\Steam\steamservice.exe
"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:7136

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x000000000000050C 0x00000000000004F4
1⤵
PID:5556

C:\Program Files (x86)\Steam\steam.exe
"C:\Program Files (x86)\Steam\steam.exe"
1⤵
PID:6064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:6284

C:\Program Files (x86)\Steam\Steam.exe
"C:\Program Files (x86)\Steam\Steam.exe"
1⤵
PID:6260
- C:\Program Files (x86)\Steam\steamsysinfo.exe
  "C:\Program Files (x86)\Steam\steamsysinfo.exe" -steamid 0 -buildid 1788652215 -logdir "C:\Program Files (x86)\Steam\logs" -nocrashdialog -query 1 -out-file C:\Users\Admin\AppData\Local\Temp\50D7.tmp
  2⤵
  PID:6388
- C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
  "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" -nocrashdialog "-lang=tr_TR" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=6260" "-buildid=1788652215" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\Steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu --disable-component-update "--gaia-url=http://disabled.invalid" "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=WinRetrieveSuggestionsOnlyOnDemand,SpareRendererForSitePerProcess,DcheckIsFatal,BlockPromptsIfIgnoredOften,WebUsbDeviceDetection,ValveFFmpegAllowLowDelayHEVC"
  2⤵
  PID:2100
- - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=gpu-process --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1864,i,8380730706356783862,1941736892259959396,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=1772 --mojo-platform-channel-handle=1856 /prefetch:2
    3⤵
    PID:4248
- - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --field-trial-handle=2136,i,8380730706356783862,1941736892259959396,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2180 --mojo-platform-channel-handle=2176 /prefetch:11
    3⤵
    - System Time Discovery
    PID:4816
- - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --field-trial-handle=2272,i,8380730706356783862,1941736892259959396,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=2436 --mojo-platform-channel-handle=2284 /prefetch:13
    3⤵
    PID:2152
- - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=renderer --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --gaia-url=http://disabled.invalid --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=4016,i,8380730706356783862,1941736892259959396,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=4040 --mojo-platform-channel-handle=4036 /prefetch:1
    3⤵
    PID:2720
- - C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe
    "C:\Program Files (x86)\Steam\bin\cef\cef.win64\steamwebhelper.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --enable-chrome-runtime --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --user-agent-product="Valve Steam Client" --buildid=1788652215 --steamid=0 --field-trial-handle=5064,i,8380730706356783862,1941736892259959396,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BlockPromptsIfIgnoredOften,DcheckIsFatal,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC,WebUsbDeviceDetection,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --enable-logging=handle --log-file=5172 --mojo-platform-channel-handle=5156 /prefetch:14
    3⤵
    PID:244
- C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
  .\bin\gldriverquery64.exe
  2⤵
  PID:980
- C:\Program Files (x86)\Steam\bin\gldriverquery.exe
  .\bin\gldriverquery.exe
  2⤵
  PID:1156
- C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
  .\bin\vulkandriverquery64.exe
  2⤵
  PID:4732
- C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
  .\bin\vulkandriverquery.exe
  2⤵
  PID:7108

C:\Program Files (x86)\Common Files\Steam\steamservice.exe
"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
1⤵
PID:4184
- C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe
  "C:\Program Files (x86)\Common Files\Steam\SteamServiceTmp.exe" /Update
  2⤵
  PID:5364

C:\Program Files (x86)\Common Files\Steam\steamservice.exe
"C:\Program Files (x86)\Common Files\Steam\steamservice.exe" /RunAsService
1⤵
PID:3244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

service_default_Public_versions.vdf

Path C:\Program Files (x86)\Common Files\Steam\service_default_Public_versions.vdf
Size 808B
SHA256 54210727dcdbd91379e4126f6b335f807b2c85d78f26821267eee6250d66bfdd
MD5 cbbf707a3beadb03ced494459048e837
SHA1 b203d6f8ae12e352e581094fad0f6ca658af6c89
SHA512 2eadff9ba3e44f501ecacc7eadae3090d6ef8d6252c41276d8816ad2e1c304120bde1db345d9888fcc44ff4f1a22f916d35d1c2bb2039347ffd1da8af7259417
TLSH
T18C018E0FD493DCFB69A00B6F675FC9C5877B1E4F9C417C276A40080892D4CAD6A0954C
MD5 SHA1 SHA512 TLSH

Submit Download

service_log.txt

Path C:\Program Files (x86)\Common Files\Steam\service_log.txt
Size 597B
SHA256 a6a424b11ad60b93f7e57000784799a37cf203517bd8877399005f56c1a1afd5
MD5 c48e6ccb338fd1dcb6e9a5dd07fb08a4
SHA1 065287bc212a10ea4d928ae1e4d0ff06eb7089b4
SHA512 10f8be0848f32f91b0fdb1ce0b9aec8bb0a9e9e4ffa645ee84e8bfbcf2bad8035a48b4329e652d213d22694e2a0e3a1ee837a313dce8ea913a4fb18241bd0658
TLSH
T105F0C8691ECAC3FB702111C12F5912013FB5AF37258B593C2278D609A6E0E5CEB603D8
MD5 SHA1 SHA512 TLSH

Submit Download

service_minimum_versions.vdf

Path C:\Program Files (x86)\Common Files\Steam\service_minimum_versions.vdf
Size 727B
SHA256 a75ecb06d45017d2289ec27dac9f418c6ef82a9352e012670a0c67161c25c52c
MD5 47ea8d10c7c8e5ab9259a6b164a9e2d3
SHA1 cdaedb2b5d5b937930eef504de997592e95f487d
SHA512 8b85dffebf9e21e436d48292fb3bce54e01b1470bc1fc7dabbee2233743c7025cd7c59523ffa1d0f1ca50d2b1edf7bb18787aa4df61d7dfec155323ae0eb1ccf
TLSH
T1DA01DC1FBCC2A8BA2BB2465B8BF78CCE6F780906549A3CC05D840C4893E8E1C1709045
MD5 SHA1 SHA512 TLSH

Submit Download

Steam.exe

Path C:\Program Files (x86)\Steam\Steam.exe
Size 4.2MB
SHA256 12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1
MD5 33bcb1c8975a4063a134a72803e0ca16
SHA1 ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65
SHA512 13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49
SSDEEP 98304:7JeV/ztZBe91oiImuUiK9N9EGQKF9lSHbr7aw:1S/hwkmg4EpbrOw
TLSH
T1C516BF62BB41C071F9C201B964BE9F7A497DAE204775C0D397D43E6A88311D32B3A79B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamService.exe

Path C:\Program Files (x86)\Steam\bin\SteamService.exe
Size 2.5MB
SHA256 ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d
MD5 ba0ea9249da4ab8f62432617489ae5a6
SHA1 d8873c5dcb6e128c39cf0c423b502821343659a7
SHA512 52958d55b03e1ddc69afc2f1a02f7813199e4b3bf114514c438ab4d10d5ca83b865ba6090550951c0a43b666c6728304009572212444a27a3f5184663f4b0b8b
SSDEEP 49152:G+v+Y6iR3Gdcw/9I4AEZvvxYtP6iJ6aFmDJRicyM/wHH1sc:G+v+YbGiwV9AEZvW0iJRma
TLSH
T14FC5AE12FA4248BDE9D21578E2EF537B4A396E101335C8C787D03F5568326D2BA3E399
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.vdf

Path C:\Program Files (x86)\Steam\config\config.vdf
Size 12KB
SHA256 92ef56b3c8929dc101ca642943b91035e47a5b33ed82c33641dc86a532b46527
MD5 badea67cfb4f2f47449a34002db120f8
SHA1 d13a332aa57828422bd117ab43ee65cd3c9710ac
SHA512 f6a6c6621ba7174816fbbdbf68d54fea45392ce0cfae7493c20636da8fed1c6a5e189ce5e9c80c48f4323349a009aa3257954d65a2496f01af45c1087bac5e5a
SSDEEP 48:Pl9XNswgsw1swWbOHGl9yEU2VwIidb3Y8CxZB2I248qnnukge8I5ubrZ2quDk99z:Pl9mGtPSoXtGTLmNMUCYPMUC/njVrr
TLSH
T12C4234476D2C40AF13599A6D12E6A0DE129C417F6A9892F3B7E25B1B7108F1DB1FC338
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.vdf

Path C:\Program Files (x86)\Steam\config\config.vdf
Size 1KB
SHA256 8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3
MD5 a2ec2e91c3ef8c42e22c4887d032b333
SHA1 e2c738a2e9400535b74e2263c7e7d1ecefe575f2
SHA512 b069d241efb19e09ec8b5e60ef6c43e00d5cc0f774b9340127c2180356dd1964ac625c1afdfaee5f99e72b26f56046fc329aadbbc365b403af765a55e9c9aab3
TLSH
T1A121002E2BBB491FCE0E0C7BC18FB9A0543FB15C39C314C4BEA4489E7D20E11506DA14
MD5 SHA1 SHA512 TLSH

Submit Download

config.vdf~RFe5c70d2.TMP

Path C:\Program Files (x86)\Steam\config\config.vdf~RFe5c70d2.TMP
Size 1KB
SHA256 f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53
MD5 6e6a2b18264504cc084caa3ad0bfc6ae
SHA1 b177d719bd3c1bc547d5c97937a584b8b7d57196
SHA512 74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679
TLSH
T1FA119E5C6BB7490FCF1E0877C28FB955582FB08D79C354D8BFA448997E10E22106ED15
MD5 SHA1 SHA512 TLSH

Submit Download

cef_log.txt

Path C:\Program Files (x86)\Steam\logs\cef_log.txt
Size 1KB
SHA256 f8f093fb177dfed14b0ac833dd31f833cd384d5a005ced3d5d69ce6160006c0f
MD5 6d279ebf2e97d999e7e87d1b2f09fc4a
SHA1 84027a3e3b69a24bb0c1e060ccf36b59f9c4436d
SHA512 ffda53872db734c7f96364f323bd5aaa17f7ee46104950644742aa681b0fdfebd26a36afeb023ee421fbe5a5c6cb3b58ad08d39a8a80529f1a4b1f3c201f6857
TLSH
T10121BE77A6A405038EF856FEF494BDF125C1400FA716F57C58390908E3E80ED39E61E4
MD5 SHA1 SHA512 TLSH

Submit Download

btnOvrOffBottom.tga_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\btnOvrOffBottom.tga_
Size 444B
SHA256 ecd13153d9d438809a38de30f3abbb0f6f92837a7e3cacb442a9a9309bcd78d9
MD5 89cb2bc5ccdab01b0653d4dbb3d6a062
SHA1 afb947fffd5f5f3723e0c8c3b52cb8cbff406ee9
SHA512 e5bef83bfad930e2b68720e00d450aa879619dcabcf8d96f9f8c47636a95a9662bc91b04cfa9160081d8af79a1257b75647d89677123f28b8c609808d5b86653
TLSH
T1CFF004040C400137C744757DDCD7C5CD77D4F4301540014C57D0307504D5041D1F44D0
MD5 SHA1 SHA512 TLSH

Submit Download

[email protected]_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
Size 6KB
SHA256 5afc5816946e0d7b6d57a99a60be71d9e88670d9a63c18e249c9266d8e95cd2f
MD5 5a5715177822e69c98aab578421ae78f
SHA1 175ea27d6ef6df27fae93a724c94b2c770f78205
SHA512 b11d05dff7f9ce55c2b30de82709f5aa9b410734e1b88a6879e3489394a5b36a27389022de0a741a16f70d0639439d4f75942c3fd604567d63b9ec229d86b331
SSDEEP 48:dfnnnW6kQhYvc072yybS7WWjsHannnffw:Xr
TLSH
T161E12E6C226CC9DA805BB8F0CA19CBF804060EC9E85E11DFA0D73E8CFE38C8AE431500
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloud_localfiles.tga_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\cloud_localfiles.tga_
Size 14KB
SHA256 c7a1b0021d1f943e497c592d83050ac85a3b93aff732f9b94cd26d9c41b37ca3
MD5 c4e538289a4c12da96cec77e7a3e36d8
SHA1 12d57144c0e79edbabc8033a9bf22b1720299f2f
SHA512 db3eac8c05b7277a6ab9974c682b20350705fcf616040204bab053d98cf193c2d6fc416eb571ca67f7e53bda59ccaddc0351bf60310a64dba2d83fd9aa539ab1
SSDEEP 384:1MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMrMMMMMMMMMMMMMMMMMMMMMMMMMMMMM0MY:ABTA
TLSH
T157626B16A05E37CE310A055AD1256DA3FA2021F58355346F30FBDE1668702B71AEEFAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
Size 15KB
SHA256 983aa3928f15f5154266be7063a75e1fce87238bbe81a910219dea01d5376824
MD5 577b7286c7b05cecde9bea0a0d39740e
SHA1 144d97afe83738177a2dbe43994f14ec11e44b53
SHA512 8cd55264a6e973bb6683c6f376672b74a263b48b087240df8296735fd7ae6274ee688fdb16d7febad14288a866ea47e78b114c357a9b03471b1e72df053ebcb0
SSDEEP 192:JDApAAAAAAAAAAAAGPAAAAAAAAAAAAK5Oq:JDAfIq
TLSH
T1D5623E04FC24B31BD6B9E07EAA974B0B507F4CD9D84330D40C7A5CA8B98DB02A26643F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

[email protected]_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_
Size 92KB
SHA256 e0ce36b93ae67846424364085ad79ee24fe5c036e5f6a78a4acbe1583f22daab
MD5 323181f4e9013b8b341897abd322e56c
SHA1 85e2e4a5d38c515185415bd4aa8d24f32d428fa2
SHA512 24fc5c82e25f2ee689b0888c6905f13ae74037e8db06a39b247d525071c858e8a284600dc5e33f006a2657d04c0b045c146c2af0951c7ecdceec34082a95d004
SSDEEP 192:JjJzVPBVK2A54RrjK/MQqLVWT5qOuIToER2zrpIEl:Jd5FjKkQqLVWT5qOu+tR2znl
TLSH
T1719359726F6CFC49BC94C88EE14132D065725AE7804B2551F8B4EE30E1E7ED72E9A94C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_button_news_mousedown.tga_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_
Size 20KB
SHA256 cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2
MD5 00bf35778a90f9dfa68ce0d1a032d9b5
SHA1 de6a3d102de9a186e1585be14b49390dcb9605d6
SHA512 342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041
SSDEEP 48:X77qTxcazfhjZRRRRRRRRRRRRRRRRRRRKFvJJJhmAr:X774zmvJJJhmu
TLSH
T18F9209380E706CCE81CE9A27AB348AD2A9D2DC6F36632E348653350FC1948543EA734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tabStdBottom.tga_

Path C:\Program Files (x86)\Steam\package\tmp\graphics\tabStdBottom.tga_
Size 48B
SHA256 5caa5fa3e79dcd8ec5ec20256ed7c77efaae77e0ae8d89e4a974c484cb177d84
MD5 bd64c051ae2410eef96839a3cb7297f7
SHA1 95a5b0455d69127fe50e396153c795d9914ce0d4
SHA512 ea2f76c8cf5dc2fd15017ad9b942d020c3ad5ce1cedc2a1604137ea02f8411cfff4166ffe93c101756b404344488b304cf2b4a71c25b2929654dda9a88a88793
MD5 SHA1 SHA512

Submit Download

steam_cloudsync.ico_

Path C:\Program Files (x86)\Steam\package\tmp\public\steam_cloudsync.ico_
Size 47KB
SHA256 5aaca90948de8f7d11264ed608a2f96acba061e6463d337d658b00ed1c552449
MD5 da277b7a17374bde018ffab02015238b
SHA1 ceaafa1a1ed7d2101ad3c2884159364aacbf9dcd
SHA512 5a6e542ae9938f560d40348ceac663feaf889a6c990efdcfbea919531dbc34771fe2f0f366ab7adc15e998e5ed392d80dad78a8392f11b9c8fdf2c67f0431a53
SSDEEP 768:CHjkEJqa7vWVw70BCDiSfUpWy46032U/C0Tz+3TaZeYJqF3D7RTB6F0SBS6:CDlJdvIw72ILUsyi9/CQ+34eY4zBCph
TLSH
T19F237CBEA78A557DC9A0473840CAEA7C433A6EC5E0A7C2C751D07F5B5C35643BE0E1A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_cloudsync_posix.tga_

Path C:\Program Files (x86)\Steam\package\tmp\public\steam_cloudsync_posix.tga_
Size 64KB
SHA256 fd2abb8945c06a6b9c5444baf6ea523b52bf7a03a58b34ebe0a6a110630ed5f8
MD5 be3a210738638c4f33aa7e01cb475e26
SHA1 02276a10cd77cfd57e4c796c45d69d526f8420bd
SHA512 6a11640800df51a8d88ef4224acd39cbb051dcdd6239bee82575ca11772a6a52e40c6614af3ea61320d29b4f75fc9611f6182ad2a55d7284863fd38d89631feb
SSDEEP 1536:fQF+zt5w33333333333333333W3333333333333333333DkqbbbbbbCm/b77vBQT:d5bbbbbbCm/b77MquuamizaWraS2Dz7o
TLSH
T165535F64EB112ABC9EF1BF05A6EA967813165D42113BCCFA168D7F4231F3A319DC6D20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steam_tray.tga_

Path C:\Program Files (x86)\Steam\package\tmp\public\steam_tray.tga_
Size 1KB
SHA256 f747d5fd27e74412be05bb376c0ff12fcebb7f39c158eaa89ab6a0a9d92ef3b6
MD5 7ecf5b072a3c49209af4710481dff5c9
SHA1 6b49560eb27b2d7cd169c066208d4fd3a4863f3b
SHA512 ec9ed9d824471655a48b48324a023a7231560810f6403f0ded04af35b51dde4dcd244bd4147570ac9c5cf0c841af33caaf8de7d60cf20f6fcbedbd1717d6d262
TLSH
T12D1163C2ACCD1788DB12C53807E6E6021C320C1608B66EC9B4277356097B43CAAF649B
MD5 SHA1 SHA512 TLSH

Submit Download

filter_clean_bulgarian.txt.gz_

Path C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_
Size 23B
SHA256 6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64
MD5 836dd6b25a8902af48cd52738b675e4b
SHA1 449347c06a872bedf311046bca8d316bfba3830b
SHA512 6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80
MD5 SHA1 SHA512

Submit Download

filter_clean_schinese.txt.gz_

Path C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_schinese.txt.gz_
Size 33B
SHA256 77f0055faba992867817c485930c5f60cf64e65c65b410128426dc35fd8d862b
MD5 dd542d7ca2128ef0e7c3411b5ab9e8d3
SHA1 0a98ce0efdb5fd75d3c697f06f3c084d5882dc49
SHA512 0d0c1801d0bdf69d2010b0e26ce0a156fa50baaa0370330bdcdb879cbd09a6146d7bc89de2d5ea6f3615123a60e1be87def44c07f92de24615974e3cae2cab85
MD5 SHA1 SHA512

Submit Download

game_details_header_green.tga_

Path C:\Program Files (x86)\Steam\package\tmp\steam\cached\game_details_header_green.tga_
Size 2.1MB
SHA256 a24832de8b80e206143170a899ab91e76e85685aed74963fe2f490344bbf6427
MD5 1ed17a7d11da47608f99d98a8d249e6f
SHA1 ea3d9e0de541be2a346e93e63286f0265ac302fc
SHA512 e423be766c3d615dee6f3ed8b0b7bb5735ec13617a93f6f5403a3e7c4c379b9ab87e9fd5f0c9fa9338f656e321488d0aba895ac9f77da413e27473b2218b9ac7
SSDEEP 49152:q3m8TZFdk4Sd9DM8CsBALhExgBrPzkpRkQhbCh6:fDM8o6xgBnkkH6
TLSH
T1EEA54B0FF4A936693DC1EB9E11B1F1F438EA07534182DA93BDD79B4960C2C84A741B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_brazilian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt
Size 4KB
SHA256 0fcd7ae491b467858f2a8745c5ecdd55451399778c2119517ee686d1f264b544
MD5 0340d1a0bbdb8f3017d2326f4e351e0a
SHA1 90d078e9f732794db5b0ffeb781a1f2ed2966139
SHA512 9d23e020875ed35825169a6542512ec2ffdb349472a12eb1e59ddc635e57c8fd65fa919873821e35c755aa7d027c9a62d3d0fa617340449d7b2c4cf8dd707e93
SSDEEP 96:3aArpYaRZ8hYzaAD25nDoVIPEPVIPErKOo8D85e:Gar8iRCNDVPXP738D85e
TLSH
T1EEA113AF179911BC58BDC3ED370E4E9725CC6172662EA88895CECB0D0DE740772B3592
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_bulgarian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt
Size 6KB
SHA256 76a6bd74194efd819d33802decdfddaae893069d7000e44944dda05022cfa6d9
MD5 4c81277a127e3d65fb5065f518ffe9c2
SHA1 253264b9b56e5bac0714d5be6cade09ae74c2a3a
SHA512 be077b61f3b6d56a1f4d24957deaf18d2dff699bda6569604aac4f1edb57c3cfd0abc5e2a67809f72e31a90b4aed0813536c153886da2099376964c60e56001a
SSDEEP 192:sKVp+typPx7rYLxGnyVqY8WYw6i0KfBKKfg38m8i/:sKVpiqMLxGnyVq/YEWYWg38m8G
TLSH
T1CED18C59076964DE4631F05EA9047E4B3DCA90FF3BB38B0501E9697C3EE307572BA289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_czech.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt
Size 4KB
SHA256 650a265dffdc5dc50200bb82d56f416a3a423eecc08c962cfd1ba2d40a1ff3f7
MD5 2158881817b9163bf0fd4724d549aed4
SHA1 c500f2e8f47a11129114ee4f19524aee8fecc502
SHA512 f3594aad9d6c50254f690c903f078a5b7a58c33bd418abdad711ebb74cfbdb5564679593e08fb2d4378faaf4160d45e3d276ba1aa8a174ed77a5791bcac46f28
SSDEEP 96:20Az7xzQK8VzRZfVAxzPXRQjpqp/lSPxIjfiI7yOo8S8qQk:/Az9zozrdAZPXR6qOPOvO38S8qQk
TLSH
T127A1351D035654B899BCC26C722C45B326CC9273A76338996ACEC76C4FA714BB3B7550
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_danish.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt
Size 4KB
SHA256 fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115
MD5 03b664bd98485425c21cdf83bc358703
SHA1 0a31dcfeb1957e0b00b87c2305400d004a9a5bdb
SHA512 4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d
SSDEEP 96:iKSCj4RjGEcH6RZY77p7zrOsLEPnvIBXKvI2BqOo8380Bg3:BJj4jGnH6rY77lrOxPnQoQmq38380By
TLSH
T190910C4E5B79A1BCC8BCC6ACB22E05A3559CA13BE2322C4911CDC32D1F9785773BB152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_dutch.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt
Size 4KB
SHA256 56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192
MD5 31a29061e51e245f74bb26d103c666ad
SHA1 271e26240db3ba0dcffc10866ccfcfa1c33cf1cc
SHA512 f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8
SSDEEP 96:TnsaIWCk1TXfSRkAcXJNRZY/r/iza1GUNrzRxbM4x9yJs+Xc1AZqI79qIjiOo8nl:LsaIVATvycZNrY/KQyJs+ZZz79zji38l
TLSH
T17D91D15F136EA1FC89F8C2ACA90D42E7298DE2329227594C15DFC63D0E57417B2F61A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_english.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt
Size 4KB
SHA256 ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6
MD5 da6cd2483ad8a21e8356e63d036df55b
SHA1 0e808a400facec559e6fbab960a7bdfaab4c6b04
SHA512 06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925
SSDEEP 96:hSlb0IG997a8ICgARZ2pyUBnXPz5dc6LzIIivI/BxkHLs068:8lHmbICgAr2hJc6LkIiQ/DOLsV8
TLSH
T10F81BD6E072A71F185B1E57C760E0AD3998871BBA3221D5826DEC21C1F9711B63FB361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_finnish.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt
Size 4KB
SHA256 8ff0f3cbdf28102ff037b9cda90590e4b66e1e654b90f9aea2cd5364494d02b7
MD5 9e62fc923c65bfc3f40aaf6ec4fd1010
SHA1 8f76faff18bd64696683c2a7a04d16aac1ef7e61
SHA512 c8ff15373b37e848e6239a82424569e77c82a5fc557d17e7d2ed1d0d2b2f7d026cc1e2bc98cb5ee945c02cfefb82803c23fa6a26f48ff0adcf762f94cd5dd035
SSDEEP 96:OJCZC1RCSwhp1RZY/T4zcVYssvWIN71BIxZvaZIUZvaPOo8K8jbG:JkPwhp1rY/UcV0ALbYi38K8jK
TLSH
T133A1339E172AD1BCD0FCC5AC651840B759C8F9B7E6122C4493CA939D4DE345772B32B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_french.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt
Size 4KB
SHA256 a1f6ba57ee41e009d904905c0ce5e75a59ee6790e08542561303109e1faafa13
MD5 10c429eb58b4274af6b6ef08f376d46c
SHA1 af1e049ddb9f875c609b0f9a38651fc1867b50d3
SHA512 d8760f61760bffd8671b727d386ae220e7e6e68829a01553cfd5eb60ef8bd1d7c1b25e7b17a6db5bd17ba6712ef44999726764459318e784843c73bc4facaf46
SSDEEP 96:vk3l1CEN8RLcSMWPrfwgXWRZDbUvzBT5H5MEkJJIbcYIbsgqOo83fy8WJv:sVIEug0ETrDsB0EkQbclbsgq38Py8WJv
TLSH
T148A1F14E17FC32E965F8826E370516A35598F076F222B94859CA834C1F9B42773FB2A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_german.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt
Size 4KB
SHA256 0828572e4fa00c186dbf1d9072a6154d65cb499c6a37e338f3305f77a2fee382
MD5 5c026fd6072a7c5cf31c75818cddedec
SHA1 341aa1df1d034e6f0a7dff88d37c9f11a716cae6
SHA512 f9d28714b2a05f8d9025f1692e4d7e8baa6daf6176353f65646a38814a242ef2adededa44419edd69f10cf96ffba506dab7cb6e52111457bf69cffef12174b12
SSDEEP 96:hn6e0CBtWTkRBtWTkcBMBcVRZY13nSYzBPCN0ayRzkxjhoG8IJ8N8S3vIKa3DOoo:h6erBtWwBtWDBMBcVrYF7+3tZcQTD38P
TLSH
T1AEA1E06E077E61FDD5BED66C610985B3368CF227A313284C11CDC22D5E93477B2B9292
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_greek.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt
Size 6KB
SHA256 c0a7a1df442ac080668762df795c72aa322e9d415c41bd0a4c676a4dc0551695
MD5 189ba063d1481528cbd6e0c4afc3abaa
SHA1 40bdd169fcc59928c69eea74fd7e057096b33092
SHA512 ce59ad9b17bab4de1254e92ce4fe7d8c8242832f62ab382e8f54199a9932cd11b5800cc33895441426373d5210cc74104e0271b721a7e26ed400b716ae4d5903
SSDEEP 192:xjAVmh67hMmrdtSIWdS0ZOfdS0ZQR38a8FN:gp8nOLQR38a8j
TLSH
T1DFD19ACF72697EBCD0A8D15E188812BB27C45D39A719C9C8225DC72C7EEA0237232957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_hungarian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt
Size 4KB
SHA256 1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5
MD5 18aaaf5ffcdd21b1b34291e812d83063
SHA1 aa9c7ae8d51e947582db493f0fd1d9941880429f
SHA512 4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154
SSDEEP 96:ADKraKKnH5BpRZELDO1cMQzQNW3kjN7MIOjHfvMIOwuOo888OK:W+a5BprELDXMAQNnN1OjHfhOwu3888OK
TLSH
T13BA11EAF033A70BDEDBDC16E36184293119EB127E22B2C7A22CED71C5E136177672156
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_indonesian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_indonesian.txt
Size 4KB
SHA256 3b3c5c615fd82070cc951ab482d3de8cb12df0b3df59fbd11f9d3271fa2fbca4
MD5 1514d082b672b372cdfb8dd85c3437f1
SHA1 336a01192edb76ae6501d6974b3b6f0c05ea223a
SHA512 4d41c945ce7c94746875b0dbceb14811d4966de4e97fe047406a304162fde7e1e2a16367fc2e43978e2e5aa66749f036b4444aa2312673c2cc3af296e8b77f55
SSDEEP 96:avbCWRRc1yRZY+lDz+Xo2drTRw2IoMTb9ISQISXOo8V8El:o+2S1yrYWsEo0uWq38V8El
TLSH
T15F91B25E07AE70AD85BCC6FC660D06E31A4DE277A712394815CE8E7D0E9712733BB260
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_italian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt
Size 4KB
SHA256 b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585
MD5 8958371646901eac40807eeb2f346382
SHA1 55fb07b48a3e354f7556d7edb75144635a850903
SHA512 14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554
SSDEEP 96:5fTYcpLQ4J+4XRZauvgpJ2zyHTNb9eMuIluIVOo83zy8Xa6:xpkA3XrDQHlHV38Dy8Xa6
TLSH
T162A100BE13AA60BCA8BDD26CA20951D7258CB4F77723354801CE971D1FC7513B6B21A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_japanese.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt
Size 5KB
SHA256 fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265
MD5 7e1d15fc9ba66a868c5c6cb1c2822f83
SHA1 bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7
SHA512 0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406
SSDEEP 96:wnwSwjaxKPVcljckFEJckFzRZYwCeHalzL9L3XHwrqdJOxoPLD1hKkHzULyqI5d5:ewSwINckeJck5rY5RXwaJdykHRly38TD
TLSH
T132B11F7C93AA24B98879C2BE290C56F36949AD27ED63392145DEC02C2E7360FF5315B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_koreana.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt
Size 4KB
SHA256 3d1399f5323a3ece1b1a8b3b31f8fd7f50c3bd319ab3f1c38c6e347452c95314
MD5 202b825d0ef72096b82db255c4e747fa
SHA1 3a3265e5bbaa1d1b774195a3858f29cea75c9e75
SHA512 e8fc7cc09f431301d22a07b238179ee053505090e3c4db30ead061513fe7159f1fe8b80efc93f4597fe00f01087bbe0bb2231e13693d72c8def138657cb91566
SSDEEP 96:bno0CtiVRtncgz5d4thtF5NdLRZYyzzjBaz23//w2Dv3RFQuVSMfXIjNXIPemiOO:zorkv+gteRFTtrYxUXLLBFQjOq3838gw
TLSH
T189A1E0DF1BA721E850F9C01C1B68A5A302C8B132FB23185CADC9DF5D8E6B05776B65B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_latam.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt
Size 4KB
SHA256 05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c
MD5 7913f3f33839e3af9e10455df69866c2
SHA1 15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25
SHA512 534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804
SSDEEP 96:9FDhCIRRcJ3NkrHRZYGerQrmermz+Ejp6lLSG+oIq2K/+oIq2vgKOo8348o06:fsISbSrYrybSZYlEzKazv938o8o06
TLSH
T1F9A1969E03DD26B89CF8C05E6A09C6A3628CE173B521B84412CEC31D1D9754BF373685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_norwegian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt
Size 4KB
SHA256 c084a68b65d507eb831831aa2ab9afb9536cb99a840d248cc155ff87fad18425
MD5 58e0fcbee3cca4ef61b97928cfe89535
SHA1 1297e3af3ca9e4fe3cc5db78ebbfa642e8a2c57b
SHA512 99aff0c481e34cd0e4fcbb2af471afb56d91aa11be664462b08e17ae169ca03ef77e7063b4ecd0f38ca7b2f6dc0bf2e316c7b31dffbbcfc763cd8fae27dc78d2
SSDEEP 96:hL+9CbrRtcejaRZYBEpdzQdbRAoWxqJcz6lIb2oZIA+Oo8q80Br+:EQb1+ejarYO7Qpsecz6Sb2o2A+38q80w
TLSH
T1FF910D4E4779B1FEDA78C6AC722E06FB419CB13BD2222D4901CEC21E0E9755772BA152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_polish.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt
Size 4KB
SHA256 0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32
MD5 9b0b0e82f753cc115d87c7199885ad1b
SHA1 5743a4ab58684c1f154f84895d87f000b4e98021
SHA512 b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df
SSDEEP 96:Wa2CgROcEhwYRZYXvs9zp6SjluImGIljIjXOo89p8FR:X1wVEhwYrYQoI4fOD3838FR
TLSH
T17B91129D036E61F8DAB8C1AD6A680AD315CDF07AEA27194812CF860D4F5301773F76A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_portuguese.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt
Size 4KB
SHA256 2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04
MD5 eb8926608c5933f05a3f0090e551b15d
SHA1 a1012904d440c0e74dad336eac8793ac110f78f8
SHA512 9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a
SSDEEP 96:uIsrct89cRZetJ2Ommrzrrd2GQvqGVA9VM7KOo8388UL6:Lt89crMYOZXwSwIx38s8UL6
TLSH
T18B91225E03AD1178897DC3AD770D5A9735CCA272B93A288817CE8B0E1E87417B3F3152
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_romanian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt
Size 4KB
SHA256 f8d1972e75a320344e3c834ba0a3a6a86edb39e20ef706bda9b7965d440d1998
MD5 6367f43ea3780c4ee166454f5936b1a8
SHA1 027a2c24c8320458c49cd78053f586cb4d94ee6f
SHA512 31aab33e0d272cb43a8c160b3d37256716a683e5052192fd0e4d3cdaf30a10a9afa9d26d5d14ad216ee455627c32892a711d2bc137ee7a7df9a297f001a19e32
SSDEEP 96:Ivm7CuRPcPlXRZYIL8CzHa5nPOhqlW+HdxIo5FIox+Oo83L8FN:SmeeEPlXrYA765PO+dO5H3878FN
TLSH
T117A1529F139A60F9ADB8C0BCB6181AD3948CA172EB16398912CDC35D1E474D7B3735D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_russian.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt
Size 6KB
SHA256 08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e
MD5 e04ad6c236b6c61fc53e2cb57ced87e8
SHA1 e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4
SHA512 0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331
SSDEEP 96:c5qCHRRc8sF+RZLqls1s1pzMDqAFoJFOTfNfKIik6IiVqOo868Crsk:GxS8sErWl+s1BFpg1Zh3868Crsk
TLSH
T18BD1005907AE60ED4538E05FE9086E0B3DCA91BF3B3B170400E86E7E2DE7426727A255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_schinese.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt
Size 4KB
SHA256 948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f
MD5 56dcf7b68f70826262a6ffaffe6b1c49
SHA1 12e4272ba0e4eabc610670cdc6941f942da1eb6a
SHA512 c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2
SSDEEP 96:/BAGpCOREHce3QuRZY7yezuqY2v14q3HPG9AHINL4QI04VOo8a8Jz:Sr+re3QurY7XfHPgNL4d04V38a8Jz
TLSH
T15D81E0AD136974F84539C1BC761C4AEB304CB032B6336C881ACAD65D5E8742B37B16A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_spanish.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt
Size 4KB
SHA256 c4f821a4903c4e7faea2931c7fb1cf261eba06a9840c78fdca689f5c784c06c4
MD5 66456d2b1085446a9f2dbd9e4632754b
SHA1 8da6248b57e5c2970d853b8d21373772a34b1c28
SHA512 196c2282ba13715709ece706c9219fe70c05dd295840082e7d901b9e5592e74b1bb556782181cdbe35bd1ab0d6197fef67258b09491fabc6f27606dbed667d49
SSDEEP 96:pFDVCIRRcJ3NkrHRZYGerQrmermz+ejnclLSG+oIq2K/+oIq2vgKOo8348o06:roISbSrYrybS3YlEzKazv938o8o06
TLSH
T173A1759E03DD26B89CF8C15E6A0AC6A3618CE173B521A84412DEC31D1D9754BF373685
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_swedish.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt
Size 4KB
SHA256 4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690
MD5 b2248784049e1af0c690be2af13a4ef3
SHA1 aec7461fa46b7f6d00ff308aa9d19c39b934c595
SHA512 f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c
SSDEEP 96:cnvF+VYBVZcdOMuRZvODz1Q4EqvL8FdGPbII8ncswBIIZswpOo8V8pVKw:CvsVsV6dOJrc1qGSdGPsI3+Idp38V8vl
TLSH
T15591C05E4729A1F89A7DC1AC654D01BB18CCB03BE2622D4D11CE8B6D6EA741732FB252
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_tchinese.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt
Size 4KB
SHA256 5e4f2de5ee98d5d76f5d76fb925417d6668fba08e89f7240f923f3378e3e66f6
MD5 194a73f900a3283da4caa6c09fefcb08
SHA1 a7a8005ca77b9f5d9791cb66fcdf6579763b2abb
SHA512 25842535c165d48f4cf4fa7fd06818ec5585cc3719eff933f5776a842713d7adb5667c3b9b1a122a1152450e797535fc7a8e97ebdd31c14b4d4900a33ede01f3
SSDEEP 96:MBS8ClRHcPTTeRZYEIlzEDsdYIaujGRXaFHJICVkHJIDVIOo8J8Jn:DT/8PTTerY7VK+4qFHGvHGC38J8Jn
TLSH
T171819D6E122D64FD493AD1BC7B0906A720DCB033B5633D4A2ACED25C5F1382F76B6691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

steambootstrapper_thai.txt

Path C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt
Size 7KB
SHA256 488294b7faff720dc3ab5a72e0607761484c678b96d6bcd6aad9ee2388356a83
MD5 53f7e8ac1affb04bf132c2ca818eb01e
SHA1 bffc3e111761e4dc514c6398a07ffce8555697f6
SHA512 c2e79c2505a6fd075df113ffce92ad42c146424ca39087601daa4ed15a2b5528d478a093921d9d8a738c7b6b963275a0693ebe526b6e2135d14ced03639d0e70
SSDEEP 192:MFlO83lYUUlM1aUl1wrYy5U55Z5I5vF3k5caR57jR5qf5c5AK5D7XBzmUZT5odWn:MFNw2AMy5U55Z5I5vF3k5caj7jR5qf5q
TLSH
T185F17FB7224664D4B868561E26193392265CAD623F73F8D045CE119E5AF270BB032FF3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b27d5926cfe2be0df2c3ab0a124f348c5eb253e973fc38a3ca03eaadcf7cbef3
MD5 6563ca326dd50a243300796da9d50c31
SHA1 0d4d43573b95f9d9e1c65ad2f7c92f6b32990ced
SHA512 9deb1f97d55324c2ff327bb7db10c31b75b7273615d8da5bf9406145a33357de641f2ff564e30306b3b7170c1069a35d61484c42e78e5846e9636019c596dfd0
TLSH
T13FD0A76069E9F6E1E116153D8210021071996A92AA57620BA250451D9E3E1C356D94A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5c34ae4ef613057a35448e3e216f4b15c1e98fd7075d693b8e0ab6c299a113f6
MD5 ceb7fc35c7d4465a18fdf73456a93e97
SHA1 3bebe5078398621522619a8cd99b6a3d3a82ab4c
SHA512 7cfdc842fa39a72ec36ab62d2b4b870ac2438ba205cb855a9547449b2c9f692f0838bcf12b717ff1313f5f24415730ad9962d529c928ae6f3f480a30af2cecf5
TLSH
T147D0A7A0B7D8E660E60614389610432971AAAA50AD17662AB151114D6D2E59342DD066
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

98edb02b-b0cf-4d0c-b2e3-9905b9ea3459.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\98edb02b-b0cf-4d0c-b2e3-9905b9ea3459.tmp
Size 414B
SHA256 05b7aa3835c7ac1d24fc5c4654f6f6ab6ecbb45a1d5d91fd2e85d81ce0777047
MD5 550827cf0e4c42595ad6d786bc76f144
SHA1 6d5707f239a099e6c6c3e34d0e699473a7a63727
SHA512 1c03062751cee15facc6916f5cc35ff16b62ba02fcd7ab8e8b1e9fd451da7301c7953abb3271a9a861423cb69a1dd613518ce485adae006f95011ad72077bf49
TLSH
T1F2E02BB9D824E87B18FD0B5851104719EB5413662E905D8B3F3D513D8FB06364A8286C
MD5 SHA1 SHA512 TLSH

Submit Download

9e3e16c1-5faf-4be3-8fdd-8c8746adc800.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e3e16c1-5faf-4be3-8fdd-8c8746adc800.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 d1d7263c448c0fd0530a3d612de4aaa7739d7068f75e4518c7005cccb7b894bf
MD5 520711910c7a9ba077c2aec3e7a722bd
SHA1 d2da69323619e24308b16fe7b3a51669e048797d
SHA512 d7ee62fcd0ade267239345fd68d2cb2acd75540dd5761d1e867ccadc754bc0e390008fc8415ea64079ec50206fd7d9e6bc06bdb32c31c7052911423c04a9f824
SSDEEP 96:e1ESviztqZ/kMCSelbZ5iwsnEf+mn4zx7Ki7Sqi/op6:e6HBkzJCfiwsK+Prezwp6
TLSH
T170E143D456E1D84EFF55413961E08C7A31B46D2A09CB8FDB2202E97F060BBB218DF676
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 d1224cea41a30081557add04cf2bc87aed513f7409cd9b493412f78202d79fa6
MD5 f1d49a440f1b0518b95296d0234f0e60
SHA1 cd9ef8f23d2138a8b2b893ec9f99fe16ace52487
SHA512 9fc581f0770b62ee4ecde46c2d5ee21024d02198b24c0c86d391fbd62cb6d92e481c2bea875b718fe4287b3040a42a671e9e0024a538ba4bef00ee393d969774
SSDEEP 3:MsEllllkEthXllkl2zELpzl:/M/xT02z
TLSH
T1E84404047FD51415CD0451744013C3504370D4104511F7433551D5335CCD5400C45403
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 c21c159778f715863839135892711ac5c409e2fcfa8eeae8b911dd7b6bd2416a
MD5 35b737c308bc59303d189720ccab1b34
SHA1 3646211ee12ac5392b8d61b01848ccb53abf328d
SHA512 07b45cb27d11b352a7d0fc61b2b14e744c2efff99e79d3a99d7559431c417fb324b200640ab8edaa8c38bf03d264d69fe55b8d175d81847be7404dcb5d49b48e
SSDEEP 96:DzO5N27P2VaaIKzBRB5HJGKthkzE62vIDIgoMulGTH/m3/twQ:DK5N27uVaaIK1H5pGKthkz32vIDIgo77
TLSH
T1F0C1ABF783F4856EDA1196F0EA086E1FCE1C0952436C3C5A85E46E1BA3F64B1E141B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a84ad0a7a3208c8564e56e0e8c5f644446deacba321c81f05b34753aba28005c
MD5 b5ce7f8d14376fc82e609b9e4b2a5f68
SHA1 7ef5ee51b07b5a2ebd14b418c12053cce38bc470
SHA512 d4e4bab8b16b361486ba731eddd150a0e38c701402a7c4b195837a7acb3ba133ee7fad2c305f2dead38315eb462e6df30e4d0da7cd0fb1486897679f5ef074aa
SSDEEP 192:DK5N27mCVaaIK1H5pGKthkz32vIDIgomr/m3/vFGT:DK5N27mCVaaIK1H5pGKthkz32vIDIgog
TLSH
T1B5D1CDF783E4866DDA1192F0EA086E1FCE1C0952436C3C5A85E4AF1B93F64B1E141B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 cd770eb8382c7881a45a4a84ecec852510ab9a955bc1855c253d63a5924a01a9
MD5 f5032b9badd16f7f5e1d2f29f04a7b85
SHA1 2a235fb1ac85a1520782ae97aba65d95f2c21935
SHA512 ebf1cb144ac184d9107f2b1a790bb6bd939bb407e46e7eebd484d34ed068c2ca057fd832c7b6c5a42f2354ade615c6a1bc7f3ce228b717a3c62edfbb1e3ce86c
TLSH
T186D022631B4630B9BF7C7FC1746AAC8FC72720220882DEF854D2E89E16358AC860B14C
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 c552927188808cb3a4e1ed035b26fb51722c8a018c15bf1c5586ee671a0be9af
MD5 c018ba37cdbed13fe4aacb25dcebc2bf
SHA1 8570479b5c54ad130fa18bb4c64d566b63040acb
SHA512 7635bb59a72ede14cf9230c45c8033949f5913c57c8b2c36d226fd7f99c917b93f2ac7c80ece01168d36cf77407a9f16b719bac8780563062c257ce57a11b94f
SSDEEP 384:sxRo9mW9/fEsFhg+OFj/5h6EK/IykvOXUliEH9U3:s89mW9/fthDg/5cF0v6qNdS
TLSH
T1F092D6425920C9778CC7DA19BE357F62E7F910239C915E8CAAFCC91C04EA2FD261781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 123663561a701105828bae2812e26c3aa89ba1bda49a758ac577697f6047c91a
MD5 3312873036b72f0e21bc506e54ce9e59
SHA1 a293d23a1b32906dc9e741879c0f7fa92e522556
SHA512 1037f09186d42c77c18a5092d4c9447a042c4cfa34ec1a78a9e0bcba808523b26f6c25e07896f72f93e90519c7cd214ae45cd2d4b103ecd3a9761e441f6324e7
SSDEEP 384:sxRoxmW9/fEs6Wvlhg+hFB/5oA6/a/Iy6GvIXUliEH9U3:s8xmW9/fSYlhDF/5o3IPvUqNdS
TLSH
T115A2C6525920C9B7CCC7DA19BE35BF61D6F924239C915E8C6AFCC91C04EA2FD260681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 d77767d22087213a76e26fabab4980946ab88161a9236d21fc8c9dc682eb034b
MD5 1784b5e101d08dba85a7a5a198d0828b
SHA1 f32418cf6ec94dc59d6123147c0b33e4bc2afa60
SHA512 27905cded143f80580257ff06c883fd72bd42594a859c901cc29a2b6b14488bb002aac91bf7bba535ec4a7194361749bf55285f71cdf7599222c15fcd31c1118
SSDEEP 384:sxRH9mz9/fEsSdg+DFW/5h8/KvOWUliEH9U3:sb9mz9/f6dD4/54KvFqNdS
TLSH
T1CC82D5125914C9B7CCC7DA08BE357F62D6F914239C925E8CAAFCC91C04EA2FD261681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 a984cb1c279182825b8979a5e7057a0788021478a05dcd3f439dd825734d137b
MD5 d157468d289b5e35fb2bbc03ecb2b75c
SHA1 eda54a3c58ea587871f8ed0a354c286aee83cf53
SHA512 5e9ab2943f48e5b542c7c8b263768e081db373148e7959779f5929d2ceecda6c840d283899bfe84ea660b788030902bc017ac7e569c6063f2969e5d5a3f4fdaf
SSDEEP 384:sxRo9mW9/fEsFdg+OFj/5h8/Iy4vOxUliEH9U3:s89mW9/ftdDg/54ovEqNdS
TLSH
T18B92D6525910C977CCC7DA19BE35BF62D7E910239C915E8CAAFCC91C04EA2FD261781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 0ee1b37bdd2e9429c97b9e24b8d2aac21a70e11df2b32f7153468443f5457ce8
MD5 40db21315c97bd687ec704e8c7a97e94
SHA1 3c78db197e8bda0f2f820475bee3a8441b13d02f
SHA512 75ce7d3a40d844a427624a90ac7211601af06c9a07eca4b94239d9257a0bccf34f836f83a843c74b9b5b671cb9027b68db00cba587b61fb9b7460000b98e515b
SSDEEP 384:sxRoxmW9/fEswWvqHg+kZHsFB/5oA6/a/Iy6GvAXUliEH9U3:s8xmW9/f4YqHD4I/5o3IPvsqNdS
TLSH
T154A2C6465920C977CCC7DA19BE35BF62D7F924239C915E8C6AFCC91C00EA2FD260681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 5ba33fe9f2f074ca3aa13808a9bcc3aa5db41f36131212eb0621e271a6f887f7
MD5 82ff58c506a637f4c2ad6654de8b62b7
SHA1 08f5fae449bc662d657eb9e5581a5010452ccb04
SHA512 bb7f693da4235bca1587bd37231e850dbfe90f5e66227078e430e0d0d9d592ac7e156180219167747baf836ee98382e5b50c179be7d146dfc92f795081824f18
SSDEEP 768:j26Hno7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OVnaBVuw5ro9ve0K:j26HnUE7MRWgs2f02u1jawaB4wyGt
TLSH
T121D2DB7B640DCA7F4F804ADDEC19BE9F6D6802CB9698CD8047FD941C02C6BEA51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db0fa1c9-8bdf-4786-8892-132574c8304d\index-dir\the-real-index
Size 3KB
SHA256 53b3df2fe9523f7e3ce1edc9cd7fbdaf9dab0ba3e74774087c18c8d8b2a0d275
MD5 9c8bae3c7700f70f7768eb3a693b931b
SHA1 e95be98fb1d54be035863f5fd61016509177882e
SHA512 f8bcee6ccb5de3744b7754b6c5f5913e846be55f33b91beafc090bb88d39b409af788ec3dae8d648924d3fa331a2d953034cd839f0149e41dcc7770b96ca7972
TLSH
T19251C54E8C430F27EDAC527214BA1889333865DC03986D2BB9FE8134F8C73689D58668
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fdfe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db0fa1c9-8bdf-4786-8892-132574c8304d\index-dir\the-real-index~RFe59fdfe.TMP
Size 48B
SHA256 7554904b100493f2796bed8dd2e23b440af8c5616b6b4ac6da645e280f8a6f56
MD5 84b65dc93fddea07d6f6db0107f7a6ad
SHA1 d3bf01edef6de07cbedd58c553f9edff05433a2c
SHA512 a98f33b47fd33b03a631ba79e36b925ab8be31fdd2e6ebca5d7443a1b76b995fcb7589d9b36434262eb1c3502bddf2504003c8b36ab9a208e4f744cec3b6076b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 e994eec0b3a910b657067f04bba5d76bf9218610c7f0eba5ff16563f30edc2d4
MD5 23ba4d48bbe15d7bb46845f3d84c3645
SHA1 80670bc9fbd71c878ff8f4265338af4e45bedd4e
SHA512 b22dee8dcc4f3416c081360bd606e1d16189741b021075290f9738ec1bb361dd253ef7f4652979577f4b816808a9fffca3fa461557eb6daa3f3636010e79f48a
TLSH
T1D5E0D8B239A72824FCAFE7ED1874A59501417564D545EC8F211E92D750B2351389AC21
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 4a14d3a847f4e99dcf5fe43677af246f47562b86543de2e966005492d86a8627
MD5 7be04d1a7c25741a7c5cf0f546e3327e
SHA1 cbdd86d131caa9db60204c136b7a99f05dc6be68
SHA512 c6c993a39c414aad0ead873e2b817347b9a74b7176c192066bffdff998c8697e498716db019bcd817e70f7ccec3aee735ddee999303bd30e632efbdd5e8dcbe6
TLSH
T16DE068B23DE72820EC6FA3ED5874A49501847D64C804AC8F211FB2C350B2252385AC21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 cfe7c39c133012af184e628420e9d352add108b2caceaf8956c315b772a7c0e8
MD5 60d95636b51b97d498a82c07ff4e7b90
SHA1 20139da6ef985aadc7cd228ad4c0ebd615f6e3aa
SHA512 f90c4469bbbdc5dced43ef754980e88ba09362f6e17770f4921296e8c62aa817f7c87bea56533d36121337c425730a10f095735416cd0c245910573af81357f1
TLSH
T15AA002618D89D151C40206F410EED38473915CD916451B4976A8D0988CD114595DA371
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59afaf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59afaf.TMP
Size 48B
SHA256 dcffa7eb41932150c54eafe86da87e2031099a13b258a57b2f3647eb60560506
MD5 985aa1ba872d111d1f354afaf95605ea
SHA1 5336f0e1f732b14aea92be83f0e6e8e6d680081e
SHA512 6cff4e28256eedabe41cad04051ed92dc451f5caa05fa45d6a0b6bd69547c76abf8371494a61d80f01c28f0d77df396178f230a32f7ebc9025352069c29ed72a
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 870ff47e343892aacd9f98c957419b30bc7deb238e3801f412c1403d4149f690
MD5 bd4b51ddc16b2a5574132f35bae80e30
SHA1 fee9bca3b04a76373a8fb7cdf3adb1d23c6b464d
SHA512 fbf85bfd4b12bd4d82f9c9f34b758d2924b9d1439b8ce20908f90bc934a96b6413df4f8f7798ab6e7377e9555e1650101762da76aaf2bd267569db8220a9a23c
SSDEEP 96:KRVCbvlfjHWLQeg3HK4GgJHcNVIbTMHRu/bpLP7W/cKgD7K4CgN7cRZUn2fyKIcf:CVCbvlfj2LQ/3dGgJ8NVIbTMHRu/bpLI
TLSH
T194910601343B12803C7E658985F4891FA3827596761AE52B3BB805AB4F2BE1B5DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a2b57.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a2b57.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2ee414a9496922da2a55208726639b80e57da6a14845ce33c8626a8a272b11a7
MD5 8a50b2d5d68940d2082d5f446233250d
SHA1 334aa53561a4bd270dc98e16051fab2676a4c7b3
SHA512 3ffcda8fe4fa942c15a86b2f2d5af9317328d51cad3d1e861d8840e3b34f655d2a29a536fffa20bcc50e30446b080cf113d8949cc61e9d8b139ab66a1a707f97
SSDEEP 768:hrv+4UNbdz3Bc/TBOWMUtm2ONXyer1IRCzniB2eVH1SK7:hbsbV3O5SIqnlEH1l
TLSH
T1EA03C032A4989E338DE2A3D6B047B2437FB86057C6840790E9DE2F4E069B59D130F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a2b91dfeae2d12fcbd3b6fb7fb88332e6482f50559561a9bbf69a1f2610c235d
MD5 31913af05c1c5d2d430e214d63159d3f
SHA1 1cb4302225e4ed6be70d17aa9a49d5db91930a6b
SHA512 549487b6cd6a57e63dc0395b475d33b8e5948fa4b57b40656f94a26983b0a96fe18b2a91fa5a777ea35e49b2da8a9f92a44c3c67e233f0ebc211748d665321c9
SSDEEP 768:lrv+4UNbdz3QK/TBOWMUtm0StjONXyer1IRCzniwJeVH1SK7:lbsbV3hWSIqndEH1l
TLSH
T1BB03C031A558DE338DE2A396B047B3837FB82067C5C44B90E9EA1F4E059799E230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 48KB
SHA256 4e54501b4f5f3f20cc6a651b6b781387448928d8f2f6c0b62d7a49c05a1d2a32
MD5 9a6d3096cf23c74e804d025c8ed5331e
SHA1 0fa49ab000c698d74acf4c1e3f8c6f94f553a4d9
SHA512 1207594eefe416e699f9725739692c21471eb76bf10fb96f88a80c2f312fc08fe16d933907ac964cac78da133627a301a7b4f419dbb13fbdf158ad47af700dbe
SSDEEP 768:KFvj3FwgqH+oopeOOsOWMUtm0StyONXyer1IRCzni9GJsMbcjhjD184pqSW:cj3j/SIqnLmecNjW4W
TLSH
T1DE23D3F99CC3893AC8AEA743672D6E1699BCD077F0A88490F7950B0DCC6257FE306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 246da84184f5d6e424f3772f78a4e297f1aae55f864eca0e017de51cf0c343b1
MD5 6094aae020e8243703449e7c23e44fcc
SHA1 5d02bb3a2b0f0b31d2e5aac8c464d23a739c4920
SHA512 c4f5b9793b060f8c687e2b8b2bcfcaaa4ea11c06269ce0d99cbca4c303a6493196c566124fe9016d9e7217fb91c36170b2931c504bb06abe0eccbf68d79a9ab1
SSDEEP 768:KFYa3fwgZq+ooheOxsOWMUtm0St4ONXyer1IRCzni9JD184pqSW:7a3NISIqn6W4W
TLSH
T1EF1317F594C39936D8AE5383A73D6E42AEBCD063B4889980B7D55E4DCC8257FD30A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f56fa405dcc9f0da8e5c604d019c4391b6bc085c37c1da65d5b5ceb80bd6f29d
MD5 7e90d5b2ddb9263bf2f4a51b2640e927
SHA1 ab9ea7ff0c3480bfaa9fb53966b8ea28506315f4
SHA512 69d55f9689e43f55f804950bf2ec562bae2f372733c32b8bcb140dac66ea02fa81bff78a346fbf23725fbc3b851b9d5fddfd0c5a830118ab1a8f4cb03fbfd7af
SSDEEP 768:KM3EDep/TBOWMUtm0StAONXyer1IRCzni9JD184pqSW:KM37XSIqn6W4W
TLSH
T122F2B071A5559D634CE6E382F543B383BEB46073C5C89A80E9EA5F1E059365E130F80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 de53057fb030737dd3434ceee6018211e4c124c9fbc3a66d26175c97eb77009d
MD5 b76df72ba268a45042d5ae918942aaf5
SHA1 cded90b6292e74f4c7ed8c966272029efc630827
SHA512 1dde069895fe908b2f8d4d1f04e12c20651eeb631c8f92ad4299b1d11ab96524f8b810a6db3df1167a3798cd54bf7406079991880b28343f13bb1749d0776b38
SSDEEP 768:c+3Zeep/TBOWMUtm0StAONXyer1IRCzni9JD184pqSW:c+3PXSIqn6W4W
TLSH
T17AF2AF71A9559D634CFAE382F543B383BEB46063C5C89E80E9EA5F1E059365E130F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6f09cae19204c3377652eb07a09e639bea8e52fd4cf3ea8759ad9bd5674748e6
MD5 2875618a19f7a3d9d34445202194a548
SHA1 3f0571a5fa08def1aa1fae7e3e96ec0ad716fd80
SHA512 62addb32c672206d31f2a5bcf87a687b1ce1f8f3e5acdc98c9c208ac54f96136c407114856194fe76a90bdaf0eb06f1a8312761a44257dbbaa3030b4c29dc098
SSDEEP 768:2rv+4UNbdz3HrmY/TBOWMUtm0StAONXyer1IRCzni9JoK:2bsbV3HlXSIqn6oK
TLSH
T1CE03C031E558DE338DF2A396F143B7837FB8206384C44A94E9EA5B4E059799E230F947
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 70510142db6171cb8d966aeba29113bbe84e1dac0f9a5f83060d1a29698c483a
MD5 0eb4f4a0b5731e3847e3a05909b54eca
SHA1 0777d84ea14f253edfc621aead1135b0432e88d9
SHA512 0a6c58c35ded2630421249d19223a0e2cdb9022a300467d2a5988e19410ecb02ff0f7d57b562d4640d2e4fa3886f55b8e0c0dd9cf3a205d3f09245188d49e2f8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Code Cache\js\index-dir\the-real-index
Size 600B
SHA256 bfa1fc7e33b3dc096036846e8fd7fd1c26c48f28596643daf3cb78bdddcb9151
MD5 50c78de93a67faf06ca850192e7ca423
SHA1 4247736fdc3893e38b0ecbd926c45b3704f9e0ba
SHA512 0c3aa506d0076387d921212242a2c11fc15d1152c0d96139e58d778056fe994863de67513247d2965d205f374b18821a4208084fdfbb1a33a53d2f5189232520
TLSH
T14DF0A9F820998688FFA0713120CB794331B80718266BFF43D30DC771A9233E98287501
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\GPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State~RFe5cd4cc.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Network\Network Persistent State~RFe5cd4cc.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
Size 7KB
SHA256 56de113436f0eadcc0744a8bc06381dcae4fa44ef114676ac5fd20513c2ca092
MD5 2de73a30df814822ea4f7c26c5cbe428
SHA1 babe88c20ee652ec8e56d676c36d98f78ebe51e8
SHA512 bf9f27830c30685a9b02270db90ee6e3176aaa9edf4affdc55a66c28062dd2591287973904c2ae2b06be3aca478d8ef48e5e62ab2a637ceef0a00ccfe2e38cdf
SSDEEP 192:rKyJo+efTXV++UFFf8pmpvEkVbM6yIsnDjwgQ:rKyJo1X/UFt8M+kEQ
TLSH
T1F7F1631A5C64AA7F9CC6E719E9267B43D3F9203135907D48E7F88A1C28D76DC222790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences
Size 7KB
SHA256 e6893535de10791cd0af2e97e7850bf659ce4fc1fc7c0207db073e803982dc2b
MD5 d8ab8d1f7f687d1de519abcd675053f7
SHA1 6875fe31dfee8f671596e245621dc277cdddc03a
SHA512 864d8998a1f9bc8e880c038e56d9e2f3fc149987d098f0706bb4b4a77e063e8d4c97b65413b49d7144f3de9f369a3dc279984edd5e6e4fdea14618f427b150af
SSDEEP 192:rKyJo+efTXV++wpmpvEklPM6yIsnDjwgQ:rKyJo1X/wM+kwQ
TLSH
T195F1751A5C64AA7F9CC6E719EA267B43D3F9203135903D48E7F8C91C28D76DC222790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5cc4de.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Preferences~RFe5cc4de.TMP
Size 7KB
SHA256 0e78c1b6cccb74b2cfcd300af7d10302dd6bc02db1032a05a2bd2a05c25d9937
MD5 255bb50e47dbe4cf284991893c691023
SHA1 41790885f94d8e6d231e92b1340870f545981d76
SHA512 2608dcd96e5307128eca823afdd5cf94d2d9db202f9cc2e7d5046209fefc1efb458dfc9f95781d1abbbc292b812a3548a56ce7a007c3a2155aeac0f5f4fbc5c5
SSDEEP 192:rKyJojefTXV++wpmpvEklPM6yIsnDjwgQ:rKyJoeX/wM+kwQ
TLSH
T12BF1751A5C64AA7F9CC6E719EA267B43D3F9203135903D48E7F8C91C28D76DC222790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 2KB
SHA256 b5995051a49373f69e3c437edfb4d2afae2bb8685b8982c78ba71ff8009dd602
MD5 f46dded51603a008123b99a640bb8816
SHA1 9f67b5d20c764dece109eb5762fa3c91a31ba094
SHA512 77775cd848a2cb63ff1c2eebcfa63882d648cf814e740f40eb3eaf10e2d66a489181df2f272290846d60bb2944e4d1d78a49ccac57c0ed50f3d1947d5b246eb4
TLSH
T1C0516236D9E4C97796B6C061F5027A43CBB8606AB9606B94F2DE0B1D02EB5DC135381B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 1KB
SHA256 547bd0bf44541cf8f159c73c5b2a0bc35819144a0e2f0e165d450cd98acbe9af
MD5 d3435f6dca037c396a885581ca907c2e
SHA1 7fae47eceef99d523c4660d45858f858f9c725e1
SHA512 a163be80b54cd54105fbca6160342175020f25b5ad4661ff143b1d6179abc44808efa4b74520d98278e532868b0de2b4096d5341c676b170394d1cc21816902d
TLSH
T139113237D5F05A37E9A5453AA606B7530FB0806B94224B88B3CF4B4A02E38CDA567C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 2KB
SHA256 140c412a3ed0e4588e08f600bfe7f40439c81769cb299cfc16e1764fb5ba4814
MD5 bcd9c63cf9c2ae5a77d0f05403ef0791
SHA1 6961f260dd0d464c449851f228a4f46da290bea0
SHA512 3a71c5433aefce7a59184c72a9abc8bfce76b1e9c4ec2c87d0ea07c4deb51a803f6c41c5dcc9b112868b2989851ba581481e51de13abf4a25c1c4cb43f210d31
TLSH
T111516336D9A4C87796A6C061F5027A03CAB8A06AA9606B94F2DE0B1D02EB5DC135381B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State
Size 2KB
SHA256 fc5d20c88e962f82c3a072b7c0b32a5e88eb5b7f10b8698b11a296cc78d855a1
MD5 932002f5e17b1fc469c436be103e2476
SHA1 26ab32ee23158e9ad6f06e3993bd0cd1dffe6503
SHA512 8f5a89909130d6dc6da1fa8d030d4ce9d4c76a8c129896046f1e8d84bf26a9321c0717eb283bd00367b4f6cda85522b635550b88c2cff2e271369cd348e6dab3
TLSH
T113516236D9A4CC3796B6C461F9027A438EB8606AF8606B94F2DE0B1D01EB5DC135380B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5c5c02.TMP

Path C:\Users\Admin\AppData\Local\Steam\htmlcache\Local State~RFe5c5c02.TMP
Size 890B
SHA256 0e5f98dfeb6feda2ca408afee24e2cbe1ae29227af1a90c8d7f9d19b74525c21
MD5 c1a6a496b8631c79ebecac9440020b30
SHA1 5935f49d9a7aea4d4e74fd69cda132c17a9856c1
SHA512 1bfd0fdbf020f05b1b6593fad1d47cdcc1ccb621d77b3b1258205b1e2d26f311747e0f3ebaa06dba8ae01324d825665af6396803708ab4c1fd8528b639d9f065
TLSH
T168112377C8E05E67A9A5413AA216B7430EA0805BC8120B88B7DF074A11F759DA557C16
MD5 SHA1 SHA512 TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf9C67.tmp\System.dll
Size 22KB
SHA256 fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0
MD5 a36fbe922ffac9cd85a845d7a813f391
SHA1 f656a613a723cc1b449034d73551b4fcdf0dcf1a
SHA512 1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b
SSDEEP 384:V8QIl975eXqlWBrz7YLOlE/NyQH38E9VF6IYinAM+oZ5a1TN:VgPgrfYLO+rMEpYinAMxZG
TLSH
T198B29D6346105CB2DD478834B4C9B936AF7536439AE0CAD39396C1119F607C37EBC267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsf9C67.tmp\modern-wizard.bmp
Size 150KB
SHA256 16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b
MD5 3614a4be6b610f1daf6c801574f161fe
SHA1 6edee98c0084a94caa1fe0124b4c19f42b4e7de6
SHA512 06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281
SSDEEP 48:ZQEM+jeAwtwVUoYxq+HQiNE/7o+f3cbqBtpozK8lHl/GGKOFHNPf33zFYsvwL:ZkWeftwV1enu/7ozCeu8RGGvP/jFYsv
TLSH
T1F8E3E9AEB933693ECD9911B41164A7FD8B306C5C7A40666E411FF8DC0FF31CA3569852
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf9C67.tmp\nsDialogs.dll
Size 20KB
SHA256 91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0
MD5 4e5bc4458afa770636f2806ee0a1e999
SHA1 76dcc64af867526f776ab9225e7f4fe076487765
SHA512 b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162
SSDEEP 384:ABSzm+t18pZ0WAg0RhIFgnGNyQH38E9VF6IYinAM+oZfNRoZk:NupZ/Ag0/T8MEpYinAMxZ7oW
TLSH
T11EA26CA385542C33CE874E3635D8653EDBB9731664808CC25326C24197A439B7FB83AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf9C67.tmp\nsExec.dll
Size 17KB
SHA256 3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226
MD5 2095af18c696968208315d4328a2b7fe
SHA1 b1b0e70c03724b2941e92c5098cc1fc0f2b51568
SHA512 60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5
SSDEEP 384:PbGgezxEqoyGgmkNFNyQH38E9VF6IYinAM+oZhc3iMy8:T31yGLkbMEpYinAMxZAy8
TLSH
T1DE826CB749802C66CD4F8D7039D4A83A5BB9BA531BE0C1D2535BC2518B917C2FFE82A5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsProcess.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf9C67.tmp\nsProcess.dll
Size 15KB
SHA256 bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8
MD5 08072dc900ca0626e8c079b2c5bcfcf3
SHA1 35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37
SHA512 8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c
SSDEEP 192:WUl64IGsjDNyQDbnPvy2sE9jBF6IYiYF8pA5K+oZ7W76OCwy9GUe:5ZsNyQH38E9VF6IYinAM+oZYsBe
TLSH
T1E0726BB38A582C21DE4B4D3171D4853AAEB9AA571AC0C1D3634BC1518BC1BC7BBF82F5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2728_1841143677\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SteamSetup.exe.crdownload

Path C:\Users\Admin\Downloads\SteamSetup.exe.crdownload
Size 2.3MB
SHA256 7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb
MD5 1b54b70beef8eb240db31718e8f7eb5d
SHA1 da5995070737ec655824c92622333c489eb6bce4
SHA512 fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb
SSDEEP 49152:UDP/q9MIX/crfcNVBaXp1m0zyVCMwBHgFzoZhRP8:kC9MI8Hm0GCjgFc3Rk
TLSH
T11FB533116FB8D076DAE20F71E0FA86F79536FC15962A4F4B3A807B2F7835110A5047B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2152-14870-0x00007FFD17910000-0x00007FFD17911000-memory.dmp

Download

memory/2152-14869-0x00007FFD16AD0000-0x00007FFD16AD1000-memory.dmp

Download

memory/2152-15106-0x00000220E7A00000-0x00000220E80F6000-memory.dmp

Download

memory/2152-15326-0x00000220E7A00000-0x00000220E80F6000-memory.dmp

Download

memory/2720-15107-0x0000021D010B0000-0x0000021D017A6000-memory.dmp

Download

memory/2720-15108-0x0000021D01810000-0x0000021D018B8000-memory.dmp

Download

memory/3336-14515-0x0000000000E80000-0x0000000001389000-memory.dmp

Download

memory/7024-7836-0x0000000000B30000-0x0000000000FE2000-memory.dmp

Download