Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    216s
  • max time network
    216s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    18/01/2025, 19:50

General

  • Target

    https://usacsacademic.com/tournaments.php

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 53 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Detected potential entity reuse from brand STEAM.
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 40 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://usacsacademic.com/tournaments.php
    1⤵
    • Enumerates system info in registry
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:948
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbf36a3cb8,0x7ffbf36a3cc8,0x7ffbf36a3cd8
      2⤵
        PID:4980
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,7600780579445453788,11510959012326090494,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1952 /prefetch:2
        2⤵
          PID:2560
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,7600780579445453788,11510959012326090494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4652
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,7600780579445453788,11510959012326090494,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
          2⤵
            PID:4100
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,7600780579445453788,11510959012326090494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
            2⤵
              PID:4260
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,7600780579445453788,11510959012326090494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
              2⤵
                PID:3468
              • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,7600780579445453788,11510959012326090494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3192
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1932,7600780579445453788,11510959012326090494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5444 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:4908
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,7600780579445453788,11510959012326090494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
                2⤵
                  PID:1400
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,7600780579445453788,11510959012326090494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
                  2⤵
                    PID:1152
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,7600780579445453788,11510959012326090494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
                    2⤵
                      PID:4876
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,7600780579445453788,11510959012326090494,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
                      2⤵
                        PID:2760
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,7600780579445453788,11510959012326090494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
                        2⤵
                          PID:4284
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,7600780579445453788,11510959012326090494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
                          2⤵
                            PID:4400
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,7600780579445453788,11510959012326090494,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6272 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4132
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,7600780579445453788,11510959012326090494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
                            2⤵
                              PID:2004
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,7600780579445453788,11510959012326090494,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
                              2⤵
                                PID:720
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1932,7600780579445453788,11510959012326090494,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6092 /prefetch:8
                                2⤵
                                  PID:1972
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1932,7600780579445453788,11510959012326090494,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
                                  2⤵
                                  • Subvert Trust Controls: Mark-of-the-Web Bypass
                                  • NTFS ADS
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:4904
                                • C:\Users\Admin\Downloads\SteamSetup.exe
                                  "C:\Users\Admin\Downloads\SteamSetup.exe"
                                  2⤵
                                  • Executes dropped EXE
                                  • Loads dropped DLL
                                  • Adds Run key to start application
                                  • System Location Discovery: System Language Discovery
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of SetWindowsHookEx
                                  PID:3508
                                  • C:\Program Files (x86)\Steam\bin\steamservice.exe
                                    "C:\Program Files (x86)\Steam\bin\steamservice.exe" /Install
                                    3⤵
                                    • Executes dropped EXE
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • Suspicious use of AdjustPrivilegeToken
                                    • Suspicious use of SetWindowsHookEx
                                    PID:1808
                              • C:\Windows\System32\CompPkgSrv.exe
                                C:\Windows\System32\CompPkgSrv.exe -Embedding
                                1⤵
                                  PID:2296
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:4412
                                  • C:\Program Files (x86)\Steam\steam.exe
                                    "C:\Program Files (x86)\Steam\steam.exe"
                                    1⤵
                                    • Executes dropped EXE
                                    • Drops file in Program Files directory
                                    • System Location Discovery: System Language Discovery
                                    • Checks processor information in registry
                                    PID:3204
                                    • C:\Program Files (x86)\Steam\steam.exe
                                      "C:\Program Files (x86)\Steam\steam.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Loads dropped DLL
                                      • Drops file in Program Files directory
                                      • System Location Discovery: System Language Discovery
                                      • Checks processor information in registry
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious behavior: GetForegroundWindowSpam
                                      • Suspicious use of SetWindowsHookEx
                                      PID:5732
                                      • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                        "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" "-lang=en_US" "-cachedir=C:\Users\Admin\AppData\Local\Steam\htmlcache" "-steampid=5732" "-buildid=1733265492" "-steamid=0" "-logdir=C:\Program Files (x86)\Steam\logs" "-uimode=7" "-startcount=0" "-steamuniverse=Public" "-realm=Global" "-clientui=C:\Program Files (x86)\Steam\clientui" "-steampath=C:\Program Files (x86)\Steam\steam.exe" "-launcher=0" --valve-enable-site-isolation --enable-smooth-scrolling --enable-direct-write "--log-file=C:\Program Files (x86)\Steam\logs\cef_log.txt" --disable-quick-menu "--enable-features=PlatformHEVCDecoderSupport" "--disable-features=SpareRendererForSitePerProcess,DcheckIsFatal,ValveFFmpegAllowLowDelayHEVC"
                                        3⤵
                                        • Executes dropped EXE
                                        • Loads dropped DLL
                                        • Drops file in Windows directory
                                        • Checks processor information in registry
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious use of SendNotifyMessage
                                        PID:5796
                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=crashpad-handler /prefetch:4 --max-uploads=5 --max-db-size=20 --max-db-age=5 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files (x86)\Steam\dumps" "--metrics-dir=C:\Users\Admin\AppData\Local\CEF\User Data" --url=https://crash.steampowered.com/submit --annotation=platform=win64 --annotation=product=cefwebhelper --annotation=version=1733265492 --initial-client-data=0x298,0x29c,0x2a0,0x294,0x2a4,0x7ffbdf45af00,0x7ffbdf45af0c,0x7ffbdf45af18
                                          4⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:5880
                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=gpu-process --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1556,i,3816202482353809264,13109327702967106422,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=1560 --mojo-platform-channel-handle=1548 /prefetch:2
                                          4⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:6044
                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=2136,i,3816202482353809264,13109327702967106422,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2140 --mojo-platform-channel-handle=2132 /prefetch:11
                                          4⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:6308
                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --user-agent-product="Valve Steam Client" --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --field-trial-handle=2720,i,3816202482353809264,13109327702967106422,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=2728 --mojo-platform-channel-handle=2712 /prefetch:13
                                          4⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:6628
                                        • C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe
                                          "C:\Program Files (x86)\Steam\bin\cef\cef.win7x64\steamwebhelper.exe" --type=renderer --user-agent-product="Valve Steam Client" --user-data-dir="C:\Users\Admin\AppData\Local\Steam\htmlcache" --buildid=1733265492 --steamid=0 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3100,i,3816202482353809264,13109327702967106422,262144 --enable-features=PlatformHEVCDecoderSupport --disable-features=BackForwardCache,DcheckIsFatal,DocumentPictureInPictureAPI,SpareRendererForSitePerProcess,ValveFFmpegAllowLowDelayHEVC --variations-seed-version --enable-logging=handle --log-file=3104 --mojo-platform-channel-handle=3096 /prefetch:1
                                          4⤵
                                          • Executes dropped EXE
                                          • Loads dropped DLL
                                          PID:6856
                                      • C:\Program Files (x86)\Steam\bin\gldriverquery64.exe
                                        .\bin\gldriverquery64.exe
                                        3⤵
                                        • Executes dropped EXE
                                        PID:6508
                                      • C:\Program Files (x86)\Steam\bin\gldriverquery.exe
                                        .\bin\gldriverquery.exe
                                        3⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:7020
                                      • C:\Program Files (x86)\Steam\bin\vulkandriverquery64.exe
                                        .\bin\vulkandriverquery64.exe
                                        3⤵
                                        • Executes dropped EXE
                                        PID:7316
                                      • C:\Program Files (x86)\Steam\bin\vulkandriverquery.exe
                                        .\bin\vulkandriverquery.exe
                                        3⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:7472
                                  • C:\Windows\system32\AUDIODG.EXE
                                    C:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004D4
                                    1⤵
                                      PID:21560

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Program Files (x86)\Steam\Steam.exe

                                      Filesize

                                      4.2MB

                                      MD5

                                      33bcb1c8975a4063a134a72803e0ca16

                                      SHA1

                                      ed7a4e6e66511bb8b3e32cbfb5557ebcb4082b65

                                      SHA256

                                      12222b0908eb69581985f7e04aa6240e928fb08aa5a3ec36acae3440633c9eb1

                                      SHA512

                                      13f3a7d6215bb4837ea0a1a9c5ba06a985e0c80979c25cfb526a390d71a15d1737c0290a899f4705c2749982c9f6c9007c1751fef1a97b12db529b2f33c97b49

                                    • C:\Program Files (x86)\Steam\bin\SteamService.exe

                                      Filesize

                                      2.5MB

                                      MD5

                                      ba0ea9249da4ab8f62432617489ae5a6

                                      SHA1

                                      d8873c5dcb6e128c39cf0c423b502821343659a7

                                      SHA256

                                      ce177dc8cf42513ff819c7b8597c7be290f9e98632a34ecd868dc76003421f0d

                                      SHA512

                                      52958d55b03e1ddc69afc2f1a02f7813199e4b3bf114514c438ab4d10d5ca83b865ba6090550951c0a43b666c6728304009572212444a27a3f5184663f4b0b8b

                                    • C:\Program Files (x86)\Steam\config\config.vdf

                                      Filesize

                                      1KB

                                      MD5

                                      6e6a2b18264504cc084caa3ad0bfc6ae

                                      SHA1

                                      b177d719bd3c1bc547d5c97937a584b8b7d57196

                                      SHA256

                                      f3847b5e4a40d9cf76df35398bb555117dfe3626c00a91f2babdedb619d6ad53

                                      SHA512

                                      74199ff275400b451642cde0a13b56709735676959d65da11ac76dd645ab11dac5de048ff7ede0cb8adb3a3056b3ecbeb3dc7481bac3768d02051e564c74b679

                                    • C:\Program Files (x86)\Steam\config\config.vdf

                                      Filesize

                                      1KB

                                      MD5

                                      a2ec2e91c3ef8c42e22c4887d032b333

                                      SHA1

                                      e2c738a2e9400535b74e2263c7e7d1ecefe575f2

                                      SHA256

                                      8f9f970835f133258a7f740126012439385bbaa5a1d6a9d0d967a390977441c3

                                      SHA512

                                      b069d241efb19e09ec8b5e60ef6c43e00d5cc0f774b9340127c2180356dd1964ac625c1afdfaee5f99e72b26f56046fc329aadbbc365b403af765a55e9c9aab3

                                    • C:\Program Files (x86)\Steam\config\config.vdf~RFe5ad6f8.TMP

                                      Filesize

                                      184B

                                      MD5

                                      3cdebc58a05cdd75f14e64fb0d971370

                                      SHA1

                                      edf2d4a8a5fc017e29bf9fb218db7dd8b2be84fe

                                      SHA256

                                      661f122934bbc692266940a1fe2e5e51d4d460efb29d75695b8d5241c6e11da7

                                      SHA512

                                      289c40fae5ec1d3dd8b5b00dd93cf9cada2cb5c12bcfefea8c862ddf0a16dced15d6814dad771af9103b3a5d3016d301ee40058edde3fdea30d9767146d11cd6

                                    • C:\Program Files (x86)\Steam\logs\bootstrap_log.txt

                                      Filesize

                                      15KB

                                      MD5

                                      b94cd1ded86cca864db2cc26307a297a

                                      SHA1

                                      71e085b553f3113fe8519e0490ef33a4c9b9b747

                                      SHA256

                                      47510887ab8c8270d51a20450895dbde6d40b4c2a51e0c1013d1fd2b08458e6a

                                      SHA512

                                      88d28cfe57e34498d4e0a52d700b394de5495cdd2207a0000e2d19a76eaa9b422e653f45f1196156e4e01d79d3f09d7944d529bb78ed807741173f2d00a5a205

                                    • C:\Program Files (x86)\Steam\package\tmp\graphics\[email protected]_

                                      Filesize

                                      15KB

                                      MD5

                                      ed5a80646f2db86576c13465290b043f

                                      SHA1

                                      e3f60f73605e16b0c6c97b93fb1fd4a67e00112a

                                      SHA256

                                      569c9a310105c4e87e070b84ff23830252a50a6c55656c5b4607692838c90b62

                                      SHA512

                                      6168e28a1bc89a2b0e759e75a184900c2b188cfd8343b505b51277d52175013be60fafa5be5a249c3a7b2badc51ebad1c45845e806696b97e23928cbc94a0531

                                    • C:\Program Files (x86)\Steam\package\tmp\graphics\icon_button_news_mousedown.tga_

                                      Filesize

                                      20KB

                                      MD5

                                      00bf35778a90f9dfa68ce0d1a032d9b5

                                      SHA1

                                      de6a3d102de9a186e1585be14b49390dcb9605d6

                                      SHA256

                                      cab3a68b64d8bf22c44080f12d7eab5b281102a8761f804224074ab1f6130fe2

                                      SHA512

                                      342c9732ef4185dee691c9c8657a56f577f9c90fc43a4330bdc173536750cee1c40af4adac4f47ac5aca6b80ab347ebe2d31d38ea540245b38ab72ee8718a041

                                    • C:\Program Files (x86)\Steam\package\tmp\resource\filter_clean_bulgarian.txt.gz_

                                      Filesize

                                      23B

                                      MD5

                                      836dd6b25a8902af48cd52738b675e4b

                                      SHA1

                                      449347c06a872bedf311046bca8d316bfba3830b

                                      SHA256

                                      6feb83ca306745d634903cf09274b7baf0ac38e43c6b3fab1a608be344c3ef64

                                      SHA512

                                      6ab1e4a7fa9da6d33cee104344ba2ccb3e85cd2d013ba3e4c6790fd7fd482c85f5f76e9ae38c5190cdbbe246a48dae775501f7414bec4f6682a05685994e6b80

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_brazilian.txt

                                      Filesize

                                      4KB

                                      MD5

                                      0340d1a0bbdb8f3017d2326f4e351e0a

                                      SHA1

                                      90d078e9f732794db5b0ffeb781a1f2ed2966139

                                      SHA256

                                      0fcd7ae491b467858f2a8745c5ecdd55451399778c2119517ee686d1f264b544

                                      SHA512

                                      9d23e020875ed35825169a6542512ec2ffdb349472a12eb1e59ddc635e57c8fd65fa919873821e35c755aa7d027c9a62d3d0fa617340449d7b2c4cf8dd707e93

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_bulgarian.txt

                                      Filesize

                                      6KB

                                      MD5

                                      4c81277a127e3d65fb5065f518ffe9c2

                                      SHA1

                                      253264b9b56e5bac0714d5be6cade09ae74c2a3a

                                      SHA256

                                      76a6bd74194efd819d33802decdfddaae893069d7000e44944dda05022cfa6d9

                                      SHA512

                                      be077b61f3b6d56a1f4d24957deaf18d2dff699bda6569604aac4f1edb57c3cfd0abc5e2a67809f72e31a90b4aed0813536c153886da2099376964c60e56001a

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_czech.txt

                                      Filesize

                                      4KB

                                      MD5

                                      2158881817b9163bf0fd4724d549aed4

                                      SHA1

                                      c500f2e8f47a11129114ee4f19524aee8fecc502

                                      SHA256

                                      650a265dffdc5dc50200bb82d56f416a3a423eecc08c962cfd1ba2d40a1ff3f7

                                      SHA512

                                      f3594aad9d6c50254f690c903f078a5b7a58c33bd418abdad711ebb74cfbdb5564679593e08fb2d4378faaf4160d45e3d276ba1aa8a174ed77a5791bcac46f28

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_danish.txt

                                      Filesize

                                      4KB

                                      MD5

                                      03b664bd98485425c21cdf83bc358703

                                      SHA1

                                      0a31dcfeb1957e0b00b87c2305400d004a9a5bdb

                                      SHA256

                                      fdf7b42b3b027a12e1b79cb10ab9e6e34c668b04eb9e8a907d8611ba46473115

                                      SHA512

                                      4a8cdd4b98432ba9d9b36bc64aab9a2eab31a074d1cbdfab3d35a14216c60752b5580c41bbb70104993420043685d3bd47eb6637b8fcbb3f42f76a15e4be041d

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_dutch.txt

                                      Filesize

                                      4KB

                                      MD5

                                      31a29061e51e245f74bb26d103c666ad

                                      SHA1

                                      271e26240db3ba0dcffc10866ccfcfa1c33cf1cc

                                      SHA256

                                      56c8a86fa95eab0d8f34f498e079b5516b96d2a2f1ad9c2a888555e50e47f192

                                      SHA512

                                      f85865c1e9ab45e5586d3dd2b45d15265193e8a3c34b6bb1ac7e415a1ea878cfb044e8e01012e917e4f00bb9e0a422f56253f328df1bac99a145e19433354cf8

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_english.txt

                                      Filesize

                                      4KB

                                      MD5

                                      da6cd2483ad8a21e8356e63d036df55b

                                      SHA1

                                      0e808a400facec559e6fbab960a7bdfaab4c6b04

                                      SHA256

                                      ebececd3f691ac20e5b73e5c81861a01531203df3cf2baa9e1b6d004733a42a6

                                      SHA512

                                      06145861eb4803c9813a88cd715769a4baa0bab0e87b28f59aa242d4369817789f4c85114e8d0ceb502e080ec3ec03400385924ec7537e7b04f724ba7f17b925

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_finnish.txt

                                      Filesize

                                      4KB

                                      MD5

                                      9e62fc923c65bfc3f40aaf6ec4fd1010

                                      SHA1

                                      8f76faff18bd64696683c2a7a04d16aac1ef7e61

                                      SHA256

                                      8ff0f3cbdf28102ff037b9cda90590e4b66e1e654b90f9aea2cd5364494d02b7

                                      SHA512

                                      c8ff15373b37e848e6239a82424569e77c82a5fc557d17e7d2ed1d0d2b2f7d026cc1e2bc98cb5ee945c02cfefb82803c23fa6a26f48ff0adcf762f94cd5dd035

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_french.txt

                                      Filesize

                                      4KB

                                      MD5

                                      10c429eb58b4274af6b6ef08f376d46c

                                      SHA1

                                      af1e049ddb9f875c609b0f9a38651fc1867b50d3

                                      SHA256

                                      a1f6ba57ee41e009d904905c0ce5e75a59ee6790e08542561303109e1faafa13

                                      SHA512

                                      d8760f61760bffd8671b727d386ae220e7e6e68829a01553cfd5eb60ef8bd1d7c1b25e7b17a6db5bd17ba6712ef44999726764459318e784843c73bc4facaf46

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_german.txt

                                      Filesize

                                      4KB

                                      MD5

                                      5c026fd6072a7c5cf31c75818cddedec

                                      SHA1

                                      341aa1df1d034e6f0a7dff88d37c9f11a716cae6

                                      SHA256

                                      0828572e4fa00c186dbf1d9072a6154d65cb499c6a37e338f3305f77a2fee382

                                      SHA512

                                      f9d28714b2a05f8d9025f1692e4d7e8baa6daf6176353f65646a38814a242ef2adededa44419edd69f10cf96ffba506dab7cb6e52111457bf69cffef12174b12

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_greek.txt

                                      Filesize

                                      6KB

                                      MD5

                                      189ba063d1481528cbd6e0c4afc3abaa

                                      SHA1

                                      40bdd169fcc59928c69eea74fd7e057096b33092

                                      SHA256

                                      c0a7a1df442ac080668762df795c72aa322e9d415c41bd0a4c676a4dc0551695

                                      SHA512

                                      ce59ad9b17bab4de1254e92ce4fe7d8c8242832f62ab382e8f54199a9932cd11b5800cc33895441426373d5210cc74104e0271b721a7e26ed400b716ae4d5903

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_hungarian.txt

                                      Filesize

                                      4KB

                                      MD5

                                      18aaaf5ffcdd21b1b34291e812d83063

                                      SHA1

                                      aa9c7ae8d51e947582db493f0fd1d9941880429f

                                      SHA256

                                      1f45bb7bdfa01424f9237eec60eba35dc7f0dc4e8c2e193fe768fe96d3ff76d5

                                      SHA512

                                      4f3e56d1abe26b56d3f805dc85baaca450c0c7bec57ebcf8a6bb6ebb8588307dad130c83bf792bac76694909a14fd6a4d7d1e9b31e32fba11256343b9fc18154

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_indonesian.txt

                                      Filesize

                                      4KB

                                      MD5

                                      1514d082b672b372cdfb8dd85c3437f1

                                      SHA1

                                      336a01192edb76ae6501d6974b3b6f0c05ea223a

                                      SHA256

                                      3b3c5c615fd82070cc951ab482d3de8cb12df0b3df59fbd11f9d3271fa2fbca4

                                      SHA512

                                      4d41c945ce7c94746875b0dbceb14811d4966de4e97fe047406a304162fde7e1e2a16367fc2e43978e2e5aa66749f036b4444aa2312673c2cc3af296e8b77f55

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_italian.txt

                                      Filesize

                                      4KB

                                      MD5

                                      8958371646901eac40807eeb2f346382

                                      SHA1

                                      55fb07b48a3e354f7556d7edb75144635a850903

                                      SHA256

                                      b01ec64d75fd1fbd00fbeb45a3fb39244911a8b22bb43de4e0c03f205184f585

                                      SHA512

                                      14c5dbb017822336f22bf6779ccd4a66604ddc5f2c3caa24271e96f739fef007754d96844efa422d6682cbcd2d3bc902c36f0f6acb3eb87ed8d7b3f885973554

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_japanese.txt

                                      Filesize

                                      5KB

                                      MD5

                                      7e1d15fc9ba66a868c5c6cb1c2822f83

                                      SHA1

                                      bfe9a25fdc8721d7b76cecb9527a9ba7823dc3d7

                                      SHA256

                                      fc74e26a8baabbe4851109512d85173b75dbf7293d41eb3b92a1957a773c8265

                                      SHA512

                                      0892be14a858cc860766afb1c996b2c355108a7e50971ea3ec00d15069e919a6eb05a61fa839bea3938492c391e274144c5e248f4c204a602bf36adf27e5b406

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_koreana.txt

                                      Filesize

                                      4KB

                                      MD5

                                      202b825d0ef72096b82db255c4e747fa

                                      SHA1

                                      3a3265e5bbaa1d1b774195a3858f29cea75c9e75

                                      SHA256

                                      3d1399f5323a3ece1b1a8b3b31f8fd7f50c3bd319ab3f1c38c6e347452c95314

                                      SHA512

                                      e8fc7cc09f431301d22a07b238179ee053505090e3c4db30ead061513fe7159f1fe8b80efc93f4597fe00f01087bbe0bb2231e13693d72c8def138657cb91566

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_latam.txt

                                      Filesize

                                      4KB

                                      MD5

                                      7913f3f33839e3af9e10455df69866c2

                                      SHA1

                                      15fa957d0a6a2717027f5b35f4dbe5e0ab8ece25

                                      SHA256

                                      05bc1f4973c6d36002ac1b37ce46b1f941fcb4338282e0ec1ec83fb558d1a88c

                                      SHA512

                                      534e541757d19ee157a268bf7ea358b48015f400542fcfa49cdb547cd652926160f015fe2cf026d9c4996e56ab90ca3899dfd457997d915bf6bc9d7bb00ba804

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_norwegian.txt

                                      Filesize

                                      4KB

                                      MD5

                                      58e0fcbee3cca4ef61b97928cfe89535

                                      SHA1

                                      1297e3af3ca9e4fe3cc5db78ebbfa642e8a2c57b

                                      SHA256

                                      c084a68b65d507eb831831aa2ab9afb9536cb99a840d248cc155ff87fad18425

                                      SHA512

                                      99aff0c481e34cd0e4fcbb2af471afb56d91aa11be664462b08e17ae169ca03ef77e7063b4ecd0f38ca7b2f6dc0bf2e316c7b31dffbbcfc763cd8fae27dc78d2

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_polish.txt

                                      Filesize

                                      4KB

                                      MD5

                                      9b0b0e82f753cc115d87c7199885ad1b

                                      SHA1

                                      5743a4ab58684c1f154f84895d87f000b4e98021

                                      SHA256

                                      0bdeee9fa28d54d384e06ea646fbcfe3f06698a31dfdc1a50703ffe83ad78d32

                                      SHA512

                                      b7780b82fbe705bc8e5a527c011eb685c99ef0b2eb810617b9f82b891341af95ef1c2f46dce9e458c0c4dcc3e7a0d21db6c77f03419cd1c4b521a9b72f9017df

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_portuguese.txt

                                      Filesize

                                      4KB

                                      MD5

                                      eb8926608c5933f05a3f0090e551b15d

                                      SHA1

                                      a1012904d440c0e74dad336eac8793ac110f78f8

                                      SHA256

                                      2ed2b0d654d60e0a82b0968a91d568b775144e9d92f2b077b6da75f85ad12d04

                                      SHA512

                                      9113c42c38836f71ff0cc7019aff8c873845f47fbf1ab97e981cb038f4d8495b6df784402b1ee9666e8e567ae866b0284c81e6a16efb47131d5ef88569c4843a

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_romanian.txt

                                      Filesize

                                      4KB

                                      MD5

                                      6367f43ea3780c4ee166454f5936b1a8

                                      SHA1

                                      027a2c24c8320458c49cd78053f586cb4d94ee6f

                                      SHA256

                                      f8d1972e75a320344e3c834ba0a3a6a86edb39e20ef706bda9b7965d440d1998

                                      SHA512

                                      31aab33e0d272cb43a8c160b3d37256716a683e5052192fd0e4d3cdaf30a10a9afa9d26d5d14ad216ee455627c32892a711d2bc137ee7a7df9a297f001a19e32

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_russian.txt

                                      Filesize

                                      6KB

                                      MD5

                                      e04ad6c236b6c61fc53e2cb57ced87e8

                                      SHA1

                                      e9d4846b7e6cc755ee14a5d3fa45ee7d3bf425a4

                                      SHA256

                                      08c775efa77c2a92d369f794882e467b6e2526e61bc7aa7724f48e174524502e

                                      SHA512

                                      0dfb7e6d811d649103499018f3d115c542fcaba420ceb69124a4d837fe162ce514e7be2040860c5ef5f9c01c961fa6eea8730606b73ec107d87597989b6fd331

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_schinese.txt

                                      Filesize

                                      4KB

                                      MD5

                                      56dcf7b68f70826262a6ffaffe6b1c49

                                      SHA1

                                      12e4272ba0e4eabc610670cdc6941f942da1eb6a

                                      SHA256

                                      948cad1bb27109e008f2457248880c759d3fa98b92c5b4033b94f455cb8ac43f

                                      SHA512

                                      c3fd9caf0bd4c303a7cc300faada9cfe6dd752e82d67625b31f4c0c2c091596508bb477fe19f758fdf79b25b8ac3f5320a8785d2b6705b9bcc28a054a59454e2

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_spanish.txt

                                      Filesize

                                      4KB

                                      MD5

                                      66456d2b1085446a9f2dbd9e4632754b

                                      SHA1

                                      8da6248b57e5c2970d853b8d21373772a34b1c28

                                      SHA256

                                      c4f821a4903c4e7faea2931c7fb1cf261eba06a9840c78fdca689f5c784c06c4

                                      SHA512

                                      196c2282ba13715709ece706c9219fe70c05dd295840082e7d901b9e5592e74b1bb556782181cdbe35bd1ab0d6197fef67258b09491fabc6f27606dbed667d49

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_swedish.txt

                                      Filesize

                                      4KB

                                      MD5

                                      b2248784049e1af0c690be2af13a4ef3

                                      SHA1

                                      aec7461fa46b7f6d00ff308aa9d19c39b934c595

                                      SHA256

                                      4bf6b25bf5b18e13b04db6ed2e5ed635eb844fc52baa892f530194d9471f5690

                                      SHA512

                                      f5cee6bba20a4d05473971f7f87a36990e88a44b2855c7655b77f48f223219978d91bcd02d320c7e6c2ec368234e1d0201be85b5626ef4909e047e416e1a066c

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_tchinese.txt

                                      Filesize

                                      4KB

                                      MD5

                                      194a73f900a3283da4caa6c09fefcb08

                                      SHA1

                                      a7a8005ca77b9f5d9791cb66fcdf6579763b2abb

                                      SHA256

                                      5e4f2de5ee98d5d76f5d76fb925417d6668fba08e89f7240f923f3378e3e66f6

                                      SHA512

                                      25842535c165d48f4cf4fa7fd06818ec5585cc3719eff933f5776a842713d7adb5667c3b9b1a122a1152450e797535fc7a8e97ebdd31c14b4d4900a33ede01f3

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_thai.txt

                                      Filesize

                                      7KB

                                      MD5

                                      53f7e8ac1affb04bf132c2ca818eb01e

                                      SHA1

                                      bffc3e111761e4dc514c6398a07ffce8555697f6

                                      SHA256

                                      488294b7faff720dc3ab5a72e0607761484c678b96d6bcd6aad9ee2388356a83

                                      SHA512

                                      c2e79c2505a6fd075df113ffce92ad42c146424ca39087601daa4ed15a2b5528d478a093921d9d8a738c7b6b963275a0693ebe526b6e2135d14ced03639d0e70

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_turkish.txt

                                      Filesize

                                      4KB

                                      MD5

                                      29f9a5ab4adfae371bf980b82de2cb57

                                      SHA1

                                      6f7ef52a09b99868dd7230f513630ffe473eddf8

                                      SHA256

                                      711675edb20b3cb70acf6cf75f2eea8e0d87c8ace3e11c8df362b4517427a34f

                                      SHA512

                                      543fe63f791250e05e8fda24fd2ceadebb4c8925e8927de49ae490895c87eed3e61a9ad50237532649f99fe3165836261de215ee3f66ffbfc6d677ddeea7732a

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_ukrainian.txt

                                      Filesize

                                      6KB

                                      MD5

                                      cadd7a2f359b22580bdd6281ea23744d

                                      SHA1

                                      e82e790a7561d0908aee8e3b1af97823e147f88b

                                      SHA256

                                      3dd0edfbe68236e668fb308f92fe7c6493dbb05bfca85a48de93588f479ccc99

                                      SHA512

                                      53672dd13e6ccbe96f6d4a61297c595b6d6cba8de92caa51ccf8ab1d8a82eea5a425eab348f295b9ec27de0026ef849d9230f751a46e040be8863923f91b8519

                                    • C:\Program Files (x86)\Steam\public\steambootstrapper_vietnamese.txt

                                      Filesize

                                      4KB

                                      MD5

                                      f350c8747d77777f456037184af9212c

                                      SHA1

                                      753d8c260b852a299df76c4f215b0d2215f6a723

                                      SHA256

                                      15b6a564e05857a3d2fd6eec85a5a30c491a7553d15ffc025156b3665b919185

                                      SHA512

                                      efb86809a0b357b4fcd3ba2770c97d225d0f4d9fb7430c515e847c3dd77ee109def4bef11b650b9773c17050e618008fc03377638c1db3393ac780b5b0bc31b2

                                    • C:\Program Files (x86)\Steam\steam.exe

                                      Filesize

                                      4.2MB

                                      MD5

                                      4bf015883412d366a1423e51ea534a21

                                      SHA1

                                      e89e0e631edc7aa0cde78463e3b5a1250e3a976d

                                      SHA256

                                      b5d588810e2b68f8a92de74b9741e0120f130d1e079144d50951c54cc04ed72c

                                      SHA512

                                      3610e464336b85793da07de2dc9a4940936bc47314b0aeddd910f2558a7669249fb4d588fb29d3b862ebddc5e3cd2883fbccbde9c35ef7215c1c864525bfa4be

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      d7145ec3fa29a4f2df900d1418974538

                                      SHA1

                                      1368d579635ba1a53d7af0ed89bf0b001f149f9d

                                      SHA256

                                      efc56eb46cf3352bf706c0309d5d740bca6ac06142f9bdc5e8344b81d4d83d59

                                      SHA512

                                      5bb663ede88f8b7c96b09c1214aac68eda99bc09525ac383baa96914ff7d553ea1aed09e3c9d16893d791c81ddb164c682dfbb4759ac0bc751221f3e36558a91

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      d91478312beae099b8ed57e547611ba2

                                      SHA1

                                      4b927559aedbde267a6193e3e480fb18e75c43d7

                                      SHA256

                                      df43cd7779d9fc91fd0416155d6771bc81565e98be38689cb17caece256bf043

                                      SHA512

                                      4086c4ebe410a37d0124fc8bd00c58775e70ab2b7b5a39b4e49b332ce5b4866c6775707436395467aff9596507c96fb4896f3bf0249c5b9c99a927f31dcc1a96

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

                                      Filesize

                                      234KB

                                      MD5

                                      b103aa0b92365c317afc58726b4c6e0b

                                      SHA1

                                      d116c8d92a9120528e9b924bd4052e4574fe00af

                                      SHA256

                                      02c91db2ae55cfbac36dedf57da05364f8455f1d45f218ee76adbb6299a5b367

                                      SHA512

                                      0520e44ca902cd1e9da95e935c3e4885d3cee0c528b5d9e76512bf6a2222707a0bb2e120d3018359a6899899c19dc771dcba45a62f97264ce259fd655cb0d936

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      864B

                                      MD5

                                      90fa0e6faaaca477c1af2cdac5234828

                                      SHA1

                                      6702342d269df3ed47db5ab530758f9b6342d9bd

                                      SHA256

                                      ce55d7fb8de2b0d587ea1bc2331273b2e7ca8e025a96f8e3e86569e8cbf1ae95

                                      SHA512

                                      c0759ec3568e1a04e450798b04bcc82b7f95b9fcd208abf90ce8a744fd6acb31fcc1f3fafd1a868410609c6f9b99acaf95a22b278b1d5003a13be34a76d27e88

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      912B

                                      MD5

                                      e09c914aeb4687d23e621d4c32b033ce

                                      SHA1

                                      2158956f09581c315b70c7c4811123a5ee395c25

                                      SHA256

                                      f4b83f8589598d3aacd05f158a268f4b788fd6d1ed35d9f705ead0c107b47e60

                                      SHA512

                                      2e72248737d95a400cce98a2721fbb5db61910e771cf564f4b5a3cdb51903ef550f7e8239300e9a8100148e2e1c4bf85f9475ae90a2d5f29ab41080ea8b7c031

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      312B

                                      MD5

                                      05e31fc9edafc16252a3674cf4157897

                                      SHA1

                                      9327a81dd0bb97c951beb9d4dc5160511db02e72

                                      SHA256

                                      d6f247f23afc264b261abb1228294ffa26f0690291b9b06b3cb6bf84adf7c40c

                                      SHA512

                                      9e97d23b499db189c38ae65b946c341d8195982f0a1e50006d693a190c2fea0c7aa3e7af1ceedee4aba933f17a33e37342a4a66c4fd49d5248e6287d706991a9

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      1decc485c061e5fbfee8fd7a9b405d9f

                                      SHA1

                                      03299e4ac7beaadaf60a108729d6b3e012acb710

                                      SHA256

                                      1520aa0969342dfe4ef900f244caee3945112c8de2aa2ee174ec0fbcccf36b88

                                      SHA512

                                      20a048f7a873be04a60c0f490ce1a7c79a9b4855377d27e58fe2deaa36e559d39f361b1ff6319396b07f90d5312db6b60946c444101eaec461fb7b5082a752c5

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      2bf3e4d18ffea9f77b6293215df8ed46

                                      SHA1

                                      ff8e8278c2e1e8dafcbbabbfa4f0be336eb9152b

                                      SHA256

                                      69da5120af0ca772d2f08e452d80898c61dfc00587662dd4625695525b306697

                                      SHA512

                                      774a41c1c04cc76d1f0bf71eb5cabc2651ab25830dc0a6717d898fe83798212df93a753c0124fe570d058fac6e80528c4faee7a87cdc41bc88be99a69409c2e5

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      84b398e3f9859f722d7a8e5a20142193

                                      SHA1

                                      959b04096de3cb2dfd410a6c603680a8c272a4f0

                                      SHA256

                                      a64fef1eae4724550ebc90f9f3e6184acdcfa7f8fa8b9fa785ded500f22531f7

                                      SHA512

                                      467afb804834b51a54e552d8508b36ea6e54c30a2ab85ab823b1003bba64107c0872779e21abf995097a3ac7a71fa4c4127d7481c92cb30647c1fba318dfbfe8

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      998b018ef7afca4006df6719cc2d541a

                                      SHA1

                                      c3eb38bca5cfa8bef6904914a6b6732a28c19d40

                                      SHA256

                                      37608760556f81a27fe0bf585066a49da6715a8fadaea6081102a865ab79162b

                                      SHA512

                                      758c34eb5cbf1efe0cc466e0974bdcf0e345808a50038faf8ef7ca16232ab36ec6e739340e6cdb7d2705a7ad8c908cb4e345b2162982cb38def109f381199aa0

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      38897682f54e7c05e59e021272b404d6

                                      SHA1

                                      8ec44f8a7e94a5d377334ac6ca86c646569fb81c

                                      SHA256

                                      5d8d23467704258790f66e6262fdccf6b2b1cf4cf76c0bbcac20f6e5f8af09de

                                      SHA512

                                      ebc35af9e24494c12783450841f02d8b33974aeda5e4bbfec2c6e7844aed8685e18fadbc2e02e8d97ffd7f80020b31e2356d033c15b6464aed04583f4a6d2a99

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      2f9143d964fd4aff051935aba5d46d4c

                                      SHA1

                                      d8772627cc0f308d790920603932682685104b8b

                                      SHA256

                                      3cb8fb5b5fa1500df2a9aceab496d3479c6e7529f2461d15753dddba2235231b

                                      SHA512

                                      430eb95df77db55de39dc27946c4ffa39e2e1c38aef8d0a913715d5230662982efb01eda0ede47bfbcc0659c45334367d7916a338bf6edfff57fa93b857190ef

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      703B

                                      MD5

                                      c1c56cf96b803aca96069f26c5f2fce9

                                      SHA1

                                      1fb3e7f348443f8563815e9740535329954e324a

                                      SHA256

                                      6472150f17d17460c53b5d0dbd320a4fc81e88cfedac85edac669c00343a27aa

                                      SHA512

                                      9e9843f0d878594eb17cd26796a81d64bd488821006e36ec890b710a22e710303676997f569a217e75f4e7dafc6ea9c9eee4ade91806fcb722f6c526d22c36e2

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe597824.TMP

                                      Filesize

                                      367B

                                      MD5

                                      e7438f44ee23c4a3ac262cbcf30f1077

                                      SHA1

                                      6b1a701caaa3aa767b32ccacf0fa68e181829be9

                                      SHA256

                                      3990596c9cb56b4f5e0056ae227966ae5bcdcf236d92e2f97aa407b3f1ecb53e

                                      SHA512

                                      c269bd0570c7f54562a2a5e6baf1639429abc62d0da3780879239788e7b36ccb7710b809ac591ed16bc14588b180407ebb2e796498b6738fa223cf147bd38c3f

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d3f2a22c-eaf7-4628-b7b6-a27b8932f716.tmp

                                      Filesize

                                      6KB

                                      MD5

                                      8816cae806ecec011b2b77e0251ac010

                                      SHA1

                                      e1e288bd54b625b685c44a02eaaf334590d6f880

                                      SHA256

                                      a07ff5127aba9618851b98757566c8278e8ea7b9d4d80c0c9c8f7b6fbc2faf03

                                      SHA512

                                      987a0e9e5767ba789a1206e54966ded2b6f989a54da98c8a1cb7ea9e92d1f2528f722069cfc399c5aed6751e6d6a1ab030cbdd50884438154640b3b47475a9fb

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      46295cac801e5d4857d09837238a6394

                                      SHA1

                                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                      SHA256

                                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                      SHA512

                                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      206702161f94c5cd39fadd03f4014d98

                                      SHA1

                                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                                      SHA256

                                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                                      SHA512

                                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      1a64424f2be1cbbf7839b43233466b54

                                      SHA1

                                      84fe500bf3ed4d606cad866f815498f6e514717e

                                      SHA256

                                      5112b2521da8afdfc8fe3a100791a743b5ed506c5cd7e7824ce061212373e60e

                                      SHA512

                                      164973a9cfb0486a8917a16a10c886d57de0bc8a668bbe014b69ce53ffffb856f59939234f65af9712d90cff34cf2227f30d87d760635fdeaa3eefe31c3d067e

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      3a1b100f0f255f86621b7ce669398beb

                                      SHA1

                                      3d67d605f6828c31a3c2a06160e4d930d2611818

                                      SHA256

                                      5bd08e5b69ea9ecb520f493bb3e4e04f389f0f3a191d56ff2e58fd58d68ea1ee

                                      SHA512

                                      90ae4dd0b590f06350d7b271465b53617244096c11e5e7542312f682b3ecc8b1fbcc805dcd84a903c25c75d3221d30ffc718cac7ec296a5d64361b48af0e4f93

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      2e0c64cabd1d434e4bd9dcf0fae32fe6

                                      SHA1

                                      59243e837e671d8eaa2d1f0383a171f9070c22bb

                                      SHA256

                                      fc3114b6fb2753a97ee4793550a8d51a7c3e77060fbe2dec180539a14ba7be7f

                                      SHA512

                                      7b79de96996f4f1a02338cc4d71f4a2e4451bbe690f0d3f1f6062a2e7f19d31759986a0678e6b47f5c0754912c407429e8039e3d8198993239cfd94a08f938ad

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      10KB

                                      MD5

                                      5bc7416172df9aae458ef106363f5f1c

                                      SHA1

                                      1f83f90a3c4688a0de69c95104b20060c9c808fb

                                      SHA256

                                      583664eac221bb5f83862bcfce05ec26b5e727d512f9930d422a13eeff602564

                                      SHA512

                                      49827cc641af6317cd9d226fa990bf20edea0be3d4f646afec07bd77c358cb050f89938a09d35cb2667a53398ed2b3ffaed3228b87176790c8402d2c555b160e

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      51bc390e90a0dc26dcc1c1100fa37a06

                                      SHA1

                                      efdec9aa24cb33fe3adcfe48896d561c75cb95eb

                                      SHA256

                                      9c01c2ffb35a1975a140d78e691cc044f2d4b8053499bdef62ed66bf3992f1f3

                                      SHA512

                                      9b932656c39a16b2da55de844618b4d64c81f924695e81650b8f6fc339d55382c20e02f959d2e13b3a3aa36a45e1d3efd9ea896ed32296a21c5abf571b5dbbd4

                                    • C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnGraphiteCache\data_1

                                      Filesize

                                      264KB

                                      MD5

                                      d0d388f3865d0523e451d6ba0be34cc4

                                      SHA1

                                      8571c6a52aacc2747c048e3419e5657b74612995

                                      SHA256

                                      902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b

                                      SHA512

                                      376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17

                                    • C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_0

                                      Filesize

                                      8KB

                                      MD5

                                      cf89d16bb9107c631daabf0c0ee58efb

                                      SHA1

                                      3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b

                                      SHA256

                                      d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e

                                      SHA512

                                      8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0

                                    • C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_2

                                      Filesize

                                      8KB

                                      MD5

                                      0962291d6d367570bee5454721c17e11

                                      SHA1

                                      59d10a893ef321a706a9255176761366115bedcb

                                      SHA256

                                      ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7

                                      SHA512

                                      f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed

                                    • C:\Users\Admin\AppData\Local\Steam\htmlcache\DawnWebGPUCache\data_3

                                      Filesize

                                      8KB

                                      MD5

                                      41876349cb12d6db992f1309f22df3f0

                                      SHA1

                                      5cf26b3420fc0302cd0a71e8d029739b8765be27

                                      SHA256

                                      e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c

                                      SHA512

                                      e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e

                                    • C:\Users\Admin\AppData\Local\Steam\htmlcache\Local Storage\leveldb\MANIFEST-000001

                                      Filesize

                                      41B

                                      MD5

                                      5af87dfd673ba2115e2fcf5cfdb727ab

                                      SHA1

                                      d5b5bbf396dc291274584ef71f444f420b6056f1

                                      SHA256

                                      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                      SHA512

                                      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                    • C:\Users\Admin\AppData\Local\Temp\nsmD430.tmp\StdUtils.dll

                                      Filesize

                                      110KB

                                      MD5

                                      db11ab4828b429a987e7682e495c1810

                                      SHA1

                                      29c2c2069c4975c90789dc6d3677b4b650196561

                                      SHA256

                                      c602c44a4d4088dbf5a659f36ba1c3a9d81f8367577de0cb940c0b8afee5c376

                                      SHA512

                                      460d1ccfc0d7180eae4e6f1a326d175fec78a7d6014447a9a79b6df501fa05cd4bd90f8f7a85b7b6a4610e2fa7059e30ae6e17bc828d370e5750de9b40b9ae88

                                    • C:\Users\Admin\AppData\Local\Temp\nsmD430.tmp\System.dll

                                      Filesize

                                      22KB

                                      MD5

                                      a36fbe922ffac9cd85a845d7a813f391

                                      SHA1

                                      f656a613a723cc1b449034d73551b4fcdf0dcf1a

                                      SHA256

                                      fa367ae36bfbe7c989c24c7abbb13482fc20bc35e7812dc377aa1c281ee14cc0

                                      SHA512

                                      1d1b95a285536ddc2a89a9b3be4bb5151b1d4c018ea8e521de838498f62e8f29bb7b3b0250df73e327e8e65e2c80b4a2d9a781276bf2a51d10e7099bacb2e50b

                                    • C:\Users\Admin\AppData\Local\Temp\nsmD430.tmp\modern-wizard.bmp

                                      Filesize

                                      150KB

                                      MD5

                                      3614a4be6b610f1daf6c801574f161fe

                                      SHA1

                                      6edee98c0084a94caa1fe0124b4c19f42b4e7de6

                                      SHA256

                                      16e0edc9f47e6e95a9bcad15adbdc46be774fbcd045dd526fc16fc38fdc8d49b

                                      SHA512

                                      06e0eff28dfd9a428b31147b242f989ce3e92474a3f391ba62ac8d0d05f1a48f4cf82fd27171658acbd667eaffb94cb4e1baf17040dc3b6e8b27f39b843ca281

                                    • C:\Users\Admin\AppData\Local\Temp\nsmD430.tmp\nsDialogs.dll

                                      Filesize

                                      20KB

                                      MD5

                                      4e5bc4458afa770636f2806ee0a1e999

                                      SHA1

                                      76dcc64af867526f776ab9225e7f4fe076487765

                                      SHA256

                                      91a484dc79be64dd11bf5acb62c893e57505fcd8809483aa92b04f10d81f9de0

                                      SHA512

                                      b6f529073a943bddbcb30a57d62216c78fcc9a09424b51ac0824ebfb9cac6cae4211bda26522d6923bd228f244ed8c41656c38284c71867f65d425727dd70162

                                    • C:\Users\Admin\AppData\Local\Temp\nsmD430.tmp\nsExec.dll

                                      Filesize

                                      17KB

                                      MD5

                                      2095af18c696968208315d4328a2b7fe

                                      SHA1

                                      b1b0e70c03724b2941e92c5098cc1fc0f2b51568

                                      SHA256

                                      3e2399ae5ce16dd69f7e2c71d928cf54a1024afced8155f1fd663a3e123d9226

                                      SHA512

                                      60105dfb1cd60b4048bd7b367969f36ed6bd29f92488ba8cfa862e31942fd529cbc58e8b0c738d91d8bef07c5902ce334e36c66eae1bfe104b44a159b5615ae5

                                    • C:\Users\Admin\AppData\Local\Temp\nsmD430.tmp\nsProcess.dll

                                      Filesize

                                      15KB

                                      MD5

                                      08072dc900ca0626e8c079b2c5bcfcf3

                                      SHA1

                                      35f2bfa0b1b2a65b9475fb91af31f7b02aee4e37

                                      SHA256

                                      bb6ce83ddaad4f530a66a1048fac868dfc3b86f5e7b8e240d84d1633e385aee8

                                      SHA512

                                      8981da7f225eb78c414e9fb3c63af0c4daae4a78b4f3033df11cce43c3a22fdbf3853425fe3024f68c73d57ffb128cba4d0db63eda1402212d1c7e0ac022353c

                                    • C:\Users\Admin\Downloads\SteamSetup.exe:Zone.Identifier

                                      Filesize

                                      26B

                                      MD5

                                      fbccf14d504b7b2dbcb5a5bda75bd93b

                                      SHA1

                                      d59fc84cdd5217c6cf74785703655f78da6b582b

                                      SHA256

                                      eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

                                      SHA512

                                      aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

                                    • C:\Users\Admin\Downloads\Unconfirmed 709684.crdownload

                                      Filesize

                                      2.3MB

                                      MD5

                                      1b54b70beef8eb240db31718e8f7eb5d

                                      SHA1

                                      da5995070737ec655824c92622333c489eb6bce4

                                      SHA256

                                      7d3654531c32d941b8cae81c4137fc542172bfa9635f169cb392f245a0a12bcb

                                      SHA512

                                      fda935694d0652dab3f1017faaf95781a300b420739e0f9d46b53ce07d592a4cfa536524989e2fc9f83602d315259817638a89c4e27da709aada5d1360b717eb

                                    • memory/3204-12635-0x0000000000AC0000-0x0000000000F72000-memory.dmp

                                      Filesize

                                      4.7MB

                                    • memory/5732-12769-0x000000006EEB0000-0x00000000701F1000-memory.dmp

                                      Filesize

                                      19.3MB

                                    • memory/6628-12677-0x00007FFC008F0000-0x00007FFC008F1000-memory.dmp

                                      Filesize

                                      4KB

                                    • memory/6628-12678-0x00007FFC02040000-0x00007FFC02041000-memory.dmp

                                      Filesize

                                      4KB