hxxps://steamgg[.]net/bills-must-be-paid-free-download/

Analysis

user interaction
yes
max time kernel
477s
max time network
477s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 01:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://steamgg.net/bills-must-be-paid-free-download/
Sample260804-cah9asbb25

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
108	discord.com
109	discord.com
120	discord.com

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\symbols\dll\D3D12Core.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\GameAssembly.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\combase.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\dll\CoreUIComponents.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\ws2_32.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\DLL\hid.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\Windows.Gaming.Input.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\dll\UnityPlayer_Win64_player_il2cpp_x64.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\symbols\dll\fwpuclnt.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\dll\advapi32.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\d3d11.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\symbols\dll\opengl32.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\sechost.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\d3d11.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\powrprof.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\dll\ntdll.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\rpcrt4.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\dll\Windows.Storage.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\dll\version.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\DLL\dhcpcsvc6.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\cryptsp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\fwpuclnt.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\symbols\dll\propsys.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\wbemcomn.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\version.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\wintrust.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\kernelbase.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\dll\user32.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\symbols\dll\user32.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\dll\wbemsvc.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\fwpuclnt.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\dll\ucrtbase.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\ole32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\mswsock.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\symbols\dll\cryptsp.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\symbols\dll\combase.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\gdi32full.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\profapi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\UMPDC.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\DLL\dhcpcsvc.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\apphelp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\apphelp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\crypt32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\shcore.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\dcomp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\oleaut32.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\dll\ResourcePolicyClient.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\symbols\dll\rsaenh.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\dll\rpcrt4.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\msvcp_win.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\gpapi.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\kernel32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\apphelp.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\Windows.Storage.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dll\baselib_Win64_player_Master_il2cpp_x64.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\symbols\dll\shlwapi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\symbols\dll\winhttp.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\dll\wbemprox.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\CLBCatQ.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\DLL\audioses.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\dnsapi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\ucrtbase.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\system32\dll\user32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\system32\msctf.pdb	UnityCrashHandler64.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\symbols\dll\baselib_Win64_player_Master_il2cpp_x64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\MMDevAPI.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\CoreUIComponents.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dnsapi.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\dll\cryptsp.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\dll\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\UxTheme.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\setupapi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\bcrypt.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\symbols\dll\WLDP.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\DLL\audioses.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\gdi32full.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\wintrust.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\ntmarta.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\msasn1.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\sechost.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\hid.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\Windows.Storage.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\InputHost.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\dll\advapi32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\ResourcePolicyClient.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\oleaut32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\MMDevAPI.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\msasn1.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\fwpuclnt.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\apphelp.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\symbols\dll\setupapi.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\dll\dbghelp.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\symbols\dll\win32u.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\shell32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\oleaut32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\dnsapi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\ntdll.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\rpcrt4.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\shcore.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\nsi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\ntmarta.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\dll\WLDP.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\DLL\dhcpcsvc6.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\msvcp_win.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\symbols\dll\msvcrt.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\dll\powrprof.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\dll\CoreUIComponents.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\symbols\dll\advapi32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\winmm.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\ResourcePolicyClient.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\steam_api64.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\kernelbase.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\dll\ResourcePolicyClient.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\ntdll.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\iphlpapi.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\D3D12Core.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\dll\baselib_Win64_player_Master_il2cpp_x64.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\dll\devobj.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\symbols\dll\wbemprox.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\symbols\dll\wbemcomn.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\version.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\dll\d3d11.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\dll\ntmarta.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\dll\dcomp.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\audioses.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\kernel32.pdb	Bills Must Be Paid.exe
File opened for modification	C:\Windows\crypt32.pdb	UnityCrashHandler64.exe
File opened for modification	C:\Windows\symbols\dll\version.pdb	UnityCrashHandler64.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1676	msedge.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Bills Must Be Paid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Bills Must Be Paid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Bills Must Be Paid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Bills Must Be Paid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Bills Must Be Paid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	Bills Must Be Paid.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Bills Must Be Paid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	Bills Must Be Paid.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Bills Must Be Paid.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Bills Must Be Paid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Bills Must Be Paid.exe
Key opened	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Bills Must Be Paid.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Bills Must Be Paid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Bills Must Be Paid.exe
Key opened	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Bills Must Be Paid.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Bills Must Be Paid.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302819740337437"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{4ED3B877-1B5A-4290-9303-3550FA35B1B6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1104	msedge.exe
1104	msedge.exe
5028	Bills Must Be Paid.exe
5028	Bills Must Be Paid.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
3884	msedge.exe
5028	Bills Must Be Paid.exe
5028	Bills Must Be Paid.exe
3168	UnityCrashHandler64.exe
3168	UnityCrashHandler64.exe
3168	UnityCrashHandler64.exe
3168	UnityCrashHandler64.exe
3484	Bills Must Be Paid.exe
3484	Bills Must Be Paid.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 27 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5028	Bills Must Be Paid.exe
3484	Bills Must Be Paid.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 3884	4596	msedge.exe	85
PID 4596 wrote to memory of 1676	4596	msedge.exe	86
PID 4596 wrote to memory of 1092	4596	msedge.exe	89
PID 4596 wrote to memory of 1092	4596	msedge.exe	89
PID 4596 wrote to memory of 4568	4596	msedge.exe	88
PID 4596 wrote to memory of 4568	4596	msedge.exe	88
PID 4596 wrote to memory of 4568	4596	msedge.exe	88
PID 4596 wrote to memory of 4952	4596	msedge.exe	90
PID 4596 wrote to memory of 4952	4596	msedge.exe	90
PID 4596 wrote to memory of 4952	4596	msedge.exe	90
PID 4596 wrote to memory of 2076	4596	msedge.exe	91
PID 4596 wrote to memory of 2076	4596	msedge.exe	91
PID 4596 wrote to memory of 2076	4596	msedge.exe	91
PID 4596 wrote to memory of 1156	4596	msedge.exe	92
PID 4596 wrote to memory of 1120	4596	msedge.exe	93
PID 4596 wrote to memory of 1156	4596	msedge.exe	92
PID 4596 wrote to memory of 1156	4596	msedge.exe	92
PID 4596 wrote to memory of 1120	4596	msedge.exe	93
PID 4596 wrote to memory of 1120	4596	msedge.exe	93
PID 4596 wrote to memory of 2216	4596	msedge.exe	97
PID 4596 wrote to memory of 4368	4596	msedge.exe	98
PID 4596 wrote to memory of 2216	4596	msedge.exe	97
PID 4596 wrote to memory of 4368	4596	msedge.exe	98
PID 4596 wrote to memory of 4312	4596	msedge.exe	99
PID 4596 wrote to memory of 4312	4596	msedge.exe	99
PID 4596 wrote to memory of 4312	4596	msedge.exe	99
PID 4596 wrote to memory of 1708	4596	msedge.exe	100
PID 4596 wrote to memory of 1708	4596	msedge.exe	100
PID 4596 wrote to memory of 1708	4596	msedge.exe	100
PID 4596 wrote to memory of 1700	4596	msedge.exe	101
PID 4596 wrote to memory of 1700	4596	msedge.exe	101
PID 4596 wrote to memory of 1700	4596	msedge.exe	101
PID 4596 wrote to memory of 4440	4596	msedge.exe	102
PID 4596 wrote to memory of 4440	4596	msedge.exe	102
PID 4596 wrote to memory of 4440	4596	msedge.exe	102
PID 4596 wrote to memory of 4384	4596	msedge.exe	104
PID 4596 wrote to memory of 1476	4596	msedge.exe	105
PID 4596 wrote to memory of 1476	4596	msedge.exe	105
PID 4596 wrote to memory of 1476	4596	msedge.exe	105
PID 4596 wrote to memory of 1276	4596	msedge.exe	113
PID 4596 wrote to memory of 1276	4596	msedge.exe	113
PID 4596 wrote to memory of 1276	4596	msedge.exe	113
PID 4596 wrote to memory of 2956	4596	msedge.exe	115
PID 4596 wrote to memory of 2956	4596	msedge.exe	115
PID 4596 wrote to memory of 2956	4596	msedge.exe	115
PID 4596 wrote to memory of 4140	4596	msedge.exe	116
PID 4596 wrote to memory of 4140	4596	msedge.exe	116
PID 4596 wrote to memory of 4140	4596	msedge.exe	116
PID 4596 wrote to memory of 4476	4596	msedge.exe	118
PID 4596 wrote to memory of 4476	4596	msedge.exe	118
PID 4596 wrote to memory of 4476	4596	msedge.exe	118
PID 4596 wrote to memory of 5052	4596	msedge.exe	119
PID 4596 wrote to memory of 5052	4596	msedge.exe	119
PID 4596 wrote to memory of 5052	4596	msedge.exe	119
PID 4596 wrote to memory of 740	4596	msedge.exe	120
PID 4596 wrote to memory of 3708	4596	msedge.exe	121
PID 4596 wrote to memory of 1600	4596	msedge.exe	122
PID 4596 wrote to memory of 4652	4596	msedge.exe	124
PID 4596 wrote to memory of 4652	4596	msedge.exe	124
PID 4596 wrote to memory of 4652	4596	msedge.exe	124
PID 4596 wrote to memory of 460	4596	msedge.exe	123
PID 4596 wrote to memory of 460	4596	msedge.exe	123
PID 4596 wrote to memory of 460	4596	msedge.exe	123
PID 4596 wrote to memory of 4676	4596	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://steamgg.net/bills-must-be-paid-free-download/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff9116dc188,0x7ff9116dc194,0x7ff9116dc1a0
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,12319197957212932096,14274768833741340210,524288 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,15927166961087533805,8465253572685323800,262144 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:2
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,1231493373629481323,14622340477886165863,524288 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,7558037043754488449,573780305006846758,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,4548886867531173125,13267085022611061748,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,2350314056112768388,7655975512381731975,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,1218161240744216284,15687501214859055530,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,5947576663718694532,10706133502891564683,524288 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,4853295897746792744,6201227506278712077,524288 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5168,i,9921248267820947599,13314816777673523211,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5604,i,17694335063578124400,3122015611853654355,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=1684,i,10863012266423190012,7008226169763424736,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6492,i,10138659903341200393,10624536020204750335,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,8622772968031986389,16585455147208822434,524288 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,8622772968031986389,16585455147208822434,524288 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6692,i,4288551952686402519,4231668067915190041,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4044,i,17111220531767426365,14677062988086847309,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7144,i,14564400974949308322,9785150535137726892,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4872,i,8127043086183885284,12726159852273878239,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5632,i,15249541575489777704,11350738993237549326,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7048,i,11118306570611259722,9734060504800993064,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,3231838617313653261,11493438252697300388,524288 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,12640466927772780090,15652583235597750708,524288 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6816,i,10422966295893605546,5926579801515047829,524288 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4852,i,6852550227088155548,8308567282909771497,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4268,i,16364458026770100652,7369641078884479057,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7116,i,846149379414214599,3307592182977818617,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7128,i,12037874880688244854,11461048152529113485,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7256,i,10118393609443348482,1143865787939009994,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=4820,i,8734764847128654907,18446673079228296567,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7328,i,7904655353426838617,16876272776084202465,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6748,i,10285022536246767954,3385443825365671079,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6744,i,12150905212646353416,10415886096001064371,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7188,i,9474551099546761037,13674713477401922383,524288 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=6868,i,3358119808405640709,1988582879757374745,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=7872 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=776,i,9607253021124586738,17593579756622959794,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7884,i,11917532689574364565,2507452591456597266,524288 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=7980 /prefetch:8
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7968,i,1890391499044496141,15923827058887611045,2097152 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=7944 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7764,i,9402045636761063627,13209408663700392984,262144 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=7712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,1640212398431714790,18438490407746473579,524288 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4024,i,15072824820629475383,15041359641983738165,524288 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,16035975873542383982,8928271277733589044,524288 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,12901493401746942473,13999973006362301931,524288 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=7880 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,9558127458579643780,3775224663153612170,524288 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7712,i,10920330641341351912,5823656879435025352,524288 --field-trial-handle=2492,i,9030266074099764469,10459045956435192401,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4468

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2776

C:\Users\Admin\Downloads\BillsMustBePaid - SteamGG.NET\BillsMustBePaid - SteamGG.NET\Bills Must Be Paid.exe
"C:\Users\Admin\Downloads\BillsMustBePaid - SteamGG.NET\BillsMustBePaid - SteamGG.NET\Bills Must Be Paid.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5028
- C:\Users\Admin\Downloads\BillsMustBePaid - SteamGG.NET\BillsMustBePaid - SteamGG.NET\UnityCrashHandler64.exe
  "C:\Users\Admin\Downloads\BillsMustBePaid - SteamGG.NET\BillsMustBePaid - SteamGG.NET\UnityCrashHandler64.exe" --attach 5028 2115655569408
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  PID:3168
- - C:\Users\Admin\Downloads\BillsMustBePaid - SteamGG.NET\BillsMustBePaid - SteamGG.NET\UnityCrashHandler64.exe
    "C:\Users\Admin\Downloads\BillsMustBePaid - SteamGG.NET\BillsMustBePaid - SteamGG.NET\UnityCrashHandler64.exe" "5028" "2115655569408" "cbmUrl=" "cbmFile="
    3⤵
    PID:2404

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4a0 0x150
1⤵
PID:2248

C:\Users\Admin\Downloads\BillsMustBePaid - SteamGG.NET\BillsMustBePaid - SteamGG.NET\Bills Must Be Paid.exe
"C:\Users\Admin\Downloads\BillsMustBePaid - SteamGG.NET\BillsMustBePaid - SteamGG.NET\Bills Must Be Paid.exe"
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3484
- C:\Users\Admin\Downloads\BillsMustBePaid - SteamGG.NET\BillsMustBePaid - SteamGG.NET\UnityCrashHandler64.exe
  "C:\Users\Admin\Downloads\BillsMustBePaid - SteamGG.NET\BillsMustBePaid - SteamGG.NET\UnityCrashHandler64.exe" --attach 3484 1967736754176
  2⤵
  PID:3968
- - C:\Users\Admin\Downloads\BillsMustBePaid - SteamGG.NET\BillsMustBePaid - SteamGG.NET\UnityCrashHandler64.exe
    "C:\Users\Admin\Downloads\BillsMustBePaid - SteamGG.NET\BillsMustBePaid - SteamGG.NET\UnityCrashHandler64.exe" "3484" "1967736754176" "cbmUrl=" "cbmFile="
    3⤵
    PID:4856

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\dd41408d63254defad1f428869191aad /t 3744 /p 3484
1⤵
PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Player.log

Path C:\Users\Admin\AppData\LocalLow\Rike Games\Bills Must Be Paid\Player.log
Size 38KB
SHA256 bf247237f0b51f7261a34039ca21e628643eab742a8c4af7cc1bcaf641f1b3b7
MD5 bc363556d086bf8d57454366462ef582
SHA1 6f1a5b62088073a3f7108f32b36e6f7256ea0ed1
SHA512 c2a80efbf88a30fbdc6015a73ca6c4271140742ac32892d8928f33ca800d3c5d8245b452ac34a1441557052a19b8217bb94aa4bc3042c4a01648fb5786f20dd5
SSDEEP 192:G9gHrtuCnvg672D9zfdsvFtZvMJXUUAD0+XzVbUQtFku40UUJwO7ZxGiwjwP297d:GG4YTMJky25b4OJw6FAweSBf2
TLSH
T17003F1E321D444B9FE1149922F226FCDA3A5FD9920F93DB560090CD5BDCACAB8D4533A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config

Path C:\Users\Admin\AppData\LocalLow\Rike Games\Bills Must Be Paid\Unity\a4175daa-f1b1-4f60-93b2-08e620566564\Analytics\config
Size 293B
SHA256 83b3f90c4edf1f122c8faf9784ca0aee4dd017c65493ac181c1814211703db96
MD5 8673a8ac0b06a9d056d08d62f857ba4b
SHA1 a351bea1932270bafbe468584058fef20dcfc31e
SHA512 edf28eb7fcef654f139285d308f817ee230d6f064a4c865109d6dfe6f73c11f8f35737c8159c8a302118237ab980899ba5773f547cc9da4028643a53b08e324f
TLSH
T1CBE0C2EB680035B9D9F5C3D9E92C3A6343784E370397F8156B58182C85BB2780791D27
MD5 SHA1 SHA512 TLSH

Submit Download

values

Path C:\Users\Admin\AppData\LocalLow\Rike Games\Bills Must Be Paid\Unity\a4175daa-f1b1-4f60-93b2-08e620566564\Analytics\values
Size 134B
SHA256 3b14ff9ea7bf5c6bc73b95eadad1b56b39b227e5b1929fedd2ba75c59f127cae
MD5 24375b1869cb40ac063ced5a3055d7d8
SHA1 f5b8a9f4af4dca725c3fa7c8b4f4e042ea76a2c0
SHA512 4730d42a5d9c8ed5c74d112d7883efb980ead3c8c249101f46e3757dccf97a0031dcf87c51eb1776136da8dbb2f929c0dbbeefe86feeecfada32cbce1d9dcc4d
TLSH
T1B1C02B84CD08CA7324608D3D66D22D0341EC0092950C890066640F4D406A001940C957
MD5 SHA1 SHA512 TLSH

Submit Download

insights-crash-report.json

Path C:\Users\Admin\AppData\LocalLow\Rike Games\Bills Must Be Paid\Unity\a4175daa-f1b1-4f60-93b2-08e620566564\CrashReporter\insights-crash-report.json
Size 130KB
SHA256 89018d0421804d304e80ca884fd3d8e2e9aa3eebbcd9d5f7b5cc9bee39578335
MD5 3e1d8f102679f1b686c430d3897ad743
SHA1 d35db5c2cd4cc758b707b3d4b2e8f95714db01ca
SHA512 0e232ee0d5f8297b8888bbf6c065c303e3b39ab8756f0073b0197a92826284b03480d23f669e23b973092eee8a34cf7626de6899fd53765a095a1dce4c7d699a
SSDEEP 768:oSw9fdkqLd2QtpaoxpJH65YcqLo4Zsua5uq5uw5u1aGFZsuf5ul5ur5uA5uF5u5k:oTS47W3
TLSH
T182D35F6E42B89DAF047BB683B82FCB492D1A6445B2C0DB54D3ECEC5817EB8E14937513
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unity_insights_app_info.bin

Path C:\Users\Admin\AppData\LocalLow\Rike Games\Bills Must Be Paid\Unity\a4175daa-f1b1-4f60-93b2-08e620566564\Insights\AppInfo\unity_insights_app_info.bin
Size 32B
SHA256 168720bd8071a8af3e5a9e3d659fa97df082af2ddecd379feec318d182a4b4a8
MD5 bd0b404bba1f825190074ee32786b161
SHA1 29454b60330ce39bb7b5ab3f28ed487b2bde9902
SHA512 575947d8029ee20e1ad3b049e18fd205eb653d92cf9e87f397cea015c7f914ab6b28618e4fd2c99d80998d08ddd1b435dcd6eed579806c7aeb4db8b31767347e
MD5 SHA1 SHA512

Submit Download

session_end_event

Path C:\Users\Admin\AppData\LocalLow\Rike Games\Bills Must Be Paid\Unity\a4175daa-f1b1-4f60-93b2-08e620566564\Insights\ArchivedEvents\Session\session_end_event
Size 113B
SHA256 f6219b6ef02b75f61b6a6ea7ac271adb5d4030d0293b9f5b03618496e4c6de35
MD5 4fc10720d7b43fe878c996a40febf594
SHA1 a7d87c69682ecbfa40c46cc90573f8868f79d8e7
SHA512 2f7f323aa309349da94fa870afda221887d1324b010122eaf510e80d04b8eaa32e70fb75cc455c152228b02451a6c1bd2138047f1bf558dd39f6a973b75c0cb9
TLSH
T142B012002C06F4F651CBCD12B12458907B740033E427D81535300B744754FB70C15F00
MD5 SHA1 SHA512 TLSH

Submit Download

CrashReport2026-08-04_015831745.json.gz

Path C:\Users\Admin\AppData\LocalLow\Unity\CrashReports\CrashReport2026-08-04_015831745.json.gz
Size 5KB
SHA256 dfbb74381786c86f8d456bfe1231f40ee3d7a13fb9c001ebb3fef43db24a4168
MD5 edd88a8cb98c26645ba5c01cd5f2f4f8
SHA1 e6da89de9fa9787569c35076a46f441d74844b16
SHA512 6ad98fa91e0203205e216f242a2832ec4c225c41e1c0f849248fb72813c1dfedfc8ac2465d157ee6daa27f76e8c178afac4df365f2b3f158e1961f9df36ea5e3
SSDEEP 96:oIDVw2Schzkkyb23XHoKFqmY/3hh6Uwu0vXph0HtYg6Sfz9gnCEYBxc6G:oESgzkkI23XxoD/3h0096SbgCEYvNG
TLSH
T127B18EB30E3800CE8BC73D1182B8A425EE93A0B88F5BB4C5B40DD45786F5C756660BBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashReport2026-08-04_015831745.json.meta

Path C:\Users\Admin\AppData\LocalLow\Unity\CrashReports\CrashReport2026-08-04_015831745.json.meta
Size 65B
SHA256 dcf5428f90b9e0e826cc94797bc115c82c83a9fb055da02c22d49a57e9d7219b
MD5 f59d143c51d96966690dfb8f4305ab40
SHA1 19ba93e0bd3c3c1f49dbe406250343516fad06b7
SHA512 11cb2ea0626bd3b33a091cf83685d7e0244925512bf73059d6cb629b7f295de0727c4b6bfc17330dfbeb2ea9329956af27c87c45d00a44cb5c85cc9b745e4aaa
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

Path C:\Users\Admin\AppData\Local\D3DSCache\f4635d6e9372c97d\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
Size 64KB
SHA256 e9ccd800959cc5ce204ef5545ee92148acbeec5f9d21a101a517dea0c51db598
MD5 1e375a89c3feb47015822cae9c758685
SHA1 c3895bada94af94d514655bb67c01bb82fff92f7
SHA512 d6c4b689e3cf5120ac22f3ceab527e03f16eec7009a9a2876d099c29bf0369aae46db073efeaedf66ad6294d5ab8a64ef2deb309b028beed2b138b187c15c267
SSDEEP 3:/L+lllGlll/l/lXp9ZjrPBY0dllnlFQ1lZP:cl0dPBY03e1z
TLSH
T1975311802383032BC002833088CB0BA83E3AA20A038380228328A230C8A8B0002B0A80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

Path C:\Users\Admin\AppData\Local\D3DSCache\f4635d6e9372c97d\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
Size 4B
SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
MD5 f49655f856acb8884cc0ace29216f511
SHA1 cb0f1f87ec0455ec349aaa950c600475ac7b7b6b
SHA512 599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8
MD5 SHA1 SHA512

Submit Download

F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

Path C:\Users\Admin\AppData\Local\D3DSCache\f4635d6e9372c97d\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
Size 1KB
SHA256 e761384eb6e8a03efb8d9337915bc1ce21cf119203b3143a8b2146d87b13eeba
MD5 2e14c06573a73f4e29543d6466587334
SHA1 d7d4f2a7452df295554dd9b932cd151e81638c79
SHA512 a31486fcba794a0e4f8e3637d1041544f2cba897ecd1c66012d76e4c048b6467b251c0d85d15583b32f73f7f880bc0410e1fb0dc7d8c6b4fc0f494970633db0a
TLSH
T1F81117A8A2D79964E3F72F302EF6C8A816A3BDC25DB6D52C0341418D5F10B68D934F75
MD5 SHA1 SHA512 TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e895c713b499f7261f324b5fdd87824521729acef59d0f511383df5da893930e
MD5 855cd69f46ca80eb69346c8a580ca6b8
SHA1 edabd216a3773be95b50c047ece50793ca1b0403
SHA512 3eba5699e57eb3f6a05ab94cd60ae66b60f73621303363a5393ea34f2b8a556e243a128d41829e64f21b76f4c24cd5978cf832f4255309101adc2b7bbcb1babd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P76:fwUQC5VwBIiElEd2K57P76
TLSH
T18AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 841983b9103d708cdec40d179f34cef16e61ad553b097bfeeb794778ad0e99f9
MD5 54f3ddb50d22953880a9b6a45c25d8b5
SHA1 a52ebbb58010a02d2f9219444195892bb8380005
SHA512 9ccbc36080e78632e8d64b2dbaf5bf02f64e05ddf628e3e5e66accdc3f998409ca17a5a4b3b798576989756e352b6ca57f9072dc0f363ffa510a7a749d0d895a
SSDEEP 192:Rs8jasEs+bs+Ms+Ms+Ms+Ms+Ms+Ms+Ms+Ms+Ms+MsIMsIMsIMsIMsIMsIMsIMsIg:R3jabZbZMZMZMZMZMZMZMZMZMZM/M/Mt
TLSH
T1C9E1550382D9DBDB8F1511AB89A4975C11B03B0EEFDCD508179D89DD304E4AEF5B1AA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 1264047398755d02b1a05968b3d48bea77d8c4fd8e32a933ff057d2b8407419a
MD5 b520fada01789b192030f5ff4d0f6c0c
SHA1 c5f43e5d5a0820e8db9fab7d653ce93d503dd6b4
SHA512 a31abac1ae55e8b478be0431caea43c40fc6ff223aa0687f95a574c43cb04aba112344664a1b2fcaea84c5cdd65abf2fd1fee506dd05b94b0c8f8e197b6586d6
SSDEEP 192:Rajac2b2M2MTMTMTMTM2M2MpMpMpMaMaMRMRMMMMMMMKM2M2MTMTM4MzMzMkMJMj:Rajac2b2M2MTMTMTMTM2M2MpMpMpMaMC
TLSH
T137E1369386D4D2DF8F1A118B5AA8535C40B0370EEFDCD50907AD89ED304E4DEF9B1AA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 3d27de317349dcbf2ea4c7442c36b85d21651474b60c0c16c0f5df01a33bdcbe
MD5 609c85ecb852422899aa00b9987a373f
SHA1 74cb87764ae989f26ea0620625fe02a9bf871239
SHA512 90a8325f05b9799dbdf9217364fead48c2e5de9ac56a6d09804c42b54f18892c3b92e1ab9dcdf08184bcd8d8f288d0c4bc878b42c7bbd23ecc41d4853f3770c4
SSDEEP 48:wjPNFLst92xyJFkS2vpw/m/N98PgoBwpC5rAVWVn0fpBGMvtiU5Ow+K2xwlL:A1FgoUepw/I98wpe7cpweoeF4g
TLSH
T169A13D8E475B0CD0F7B010B3F0EA09063BB1C168F7774EAA599884BD372DBA9856241B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe598728.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598728.TMP
Size 3KB
SHA256 d23a938496fdf836baa3482a04f729d0662d497a79dc078b6424a0a26e0d177c
MD5 28a7be734a22c9ec2fb1ffa0db637791
SHA1 6d88d6c06797328e82f1128877b034f0dfa79319
SHA512 eda8964bdd7d507c9f669ed125a5772c12859b3f2e47742ee5f3acd0d607f04bca016c5901c07f80c6a8c4f5101c7c986100d359a9babd98635bbaece216b4f7
TLSH
T10261190A87534CE1F3701173F4AE42463B71C199FBB79E10A4E484BDB72CB6D816652A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 571daa01dd16da2c8f6f3cebc711e0e1428d0139c39c72d1db1d07f0fda76a41
MD5 d2276a5fa91ecdf9c2f43927139f40cd
SHA1 7380ecb68ee4654127f521fe76d88587165958e4
SHA512 7919ded70cd487181ff4c1d89a7723102e376178930dc990552df738b9ccda09802e6e8589e58c1626e0d2aed542b55a0007e7d38406d8591d0707a870b09cf3
SSDEEP 384:D4WmcBy4xOheL9Koe+wgelX+mRdmgeNa+W9m4LPGzr9ECLtWbiueAeD6+r3U7V0x:bHEXuR
TLSH
T12092ADA6C3E4C62DDC5256F5A7142D2BCE1E0968432C3D36C9E9EF4BA3D2871E20564F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 f7471c05cd1c65ad64486707316b801dc8e12adc2ec633aa5d49f7a04a35057d
MD5 0c55e8b87b22db171a5e0ab2f6c17433
SHA1 b70cd0220e526e5f8538775dc4be851b170c1728
SHA512 ab43aca6c24976900fc6910034e278a3e15b6e076ea334d036f939333927fa6dc3ea9de35bac9362276b5ce80e69f85da3076ac9fe9e0bb75db2f3699af34fff
SSDEEP 384:D4WmcBy4xOhei9Koe+wgelX+mRdmgeNa+FPGzr9ECLtWbiueAeD6KNr3U7V0yRA7:dVEXhw
TLSH
T1A7829DA6C3E4D62DDC1256F4AB142D2BCE5E0968432C3C36C9D9AF5BA3E2471E20164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 207ef5b6344e095a84a45a27833bbca12fd0c72176cfa3c2683fb40cdd50d20f
MD5 f1bca131c7f56e8a4c4eb3b0e5eb5f77
SHA1 968ff57a9cdd7bfa586e0966c79a01e6745d20ef
SHA512 ff233b572c16db1691bbc30e1cf2d73bbe4312ccac6cbd7a74aa79bfa0810e1bd194f0c2adb224b5569d0552b0838b752f600b5a396fd4613209cf7964bce352
SSDEEP 384:DWp74p+omMHUq1age+lTewuAZ9BNjk3Vai9m4ADPGfr6E9L4IpiurAe6tr6U7VRZ:vn9Uj6f
TLSH
T15B62DFFA83E0D62DDD1196F0AA146D2FCE5D0924432C3C76CAE9AE4BA3D2471E20575F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 52b349032a8ebd958c957bb681e1072fd810e44fe00e6d5e013b9e197d24988b
MD5 d65ca36b1ac63725dac506da91d86f95
SHA1 5a0245b144248627aee7cfcc0dd98b529b592002
SHA512 a8cfaf3c48769c5a9f609c955d9780daf4cb950e7748639079fd85ac983ab8559304752b3201a9b5e73077d6437a244824500d70fa0d287763cb3dddb81ffbc4
SSDEEP 192:sxZGfRuyM/jK1Ml8Mkw/fzslf8EmIdpkRHW6+WN591R4/YLc+W+0IgrJ:sxZ+gMw/fzslf5HMHb5t4/Xv9
TLSH
T15F5209156A34A977CCDBD20DB951BF53D6F54472A2900E849EFCDA1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 688a86f28200d1a24321f27f579912da700eae03d065fb4e6b8527daa6d811ad
MD5 bff4b35aec1b4a1139c0916f72114fd7
SHA1 d313274f9a7d1eaf7365f0dc6a4d986ceb8be47c
SHA512 fa404826053deb06503a8913f4f5e999e6b1be322a060ccf988a8aba6aaebf78a1573ce952a86400c3110f21fba2f7a57d7b44491093c4983f4f172654cb9d80
SSDEEP 384:sxZ+Q1w/fzs6flm+yyHbATyWNHfI4EIXGvM:s2gw/fRfl8yHbATyWdfNhGE
TLSH
T13972D656A67019B7CCFBC219B900BB67D2F5617296C00E54AEFC9E1C00E6BED6203D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 6838a567a5213307775d66913bce7b5a8d5cc28077c03496340717cf1cf1236c
MD5 d58fe6c8624961f95441d0e85655cef0
SHA1 5686a0f4d66bab916973ad91cc7d8faecf2072e1
SHA512 15cf3df72f18ff0c6b5dd0d655c7b8b0107107e18cbcc9fb06bc595061400f006b7f676fd33ce2c022fbba23ec54184893c8de639c8776e9a42103be8f8c1cce
SSDEEP 384:sxZ+QqIw/fzs6flm+yyHbATyWNHfI4EIXGvM:s2XIw/fRfl8yHbATyWdfNhGE
TLSH
T1DC72D656A67019B7CCFBC219F500BB67E2F5657296C00E54AEFC9E1C00E6BED620391B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 36772f420f3e505c959241f1e5723c706a0d4f14088760c5d7b33ad8df0ed2b4
MD5 a6ed29c2f2dcad1957f1a1a45b34c5d2
SHA1 6957a66cdf873c3a4e32cf1b3fe8f94bb9b88f1b
SHA512 a0739f4705d7be6682232c5eae5a73dae5668972a8fe0e3b3c4359bff1d709c9e8c2f648bc00c773076a5dab36a8952b0d4b4d07a7c3680a1db3445cdc0b78ad
SSDEEP 192:sxZGfRuyM/jK1Ml8Mkw/fzs6f8EmIdpkRHW6+WN59wpIXYLx+W+0Ig58J:sxZ+QMw/fzs6f5HMHb5EIX2ve
TLSH
T1035209156A34A977CCDBC20DBA51BF53D6F9447292900E949EFCDA1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e0282360af640de552251f359451a3bfab863cc8c64636f69f2b4c87981f3c9b
MD5 6fb463a4d72384b448cc81f8d39e6743
SHA1 b6916b1f2f2e6b53acdfb9180a6412a8eccdf216
SHA512 3007ffe9b3a91cfb46c6d2870221c3cf9ea0da35c7cde301a0adf8ba0e90b18e5a29987ec43851643c6f53b9bf292996496904af08a9d8ef77febcffd0a47112
SSDEEP 768:zbs6pD1WvxzUj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNEro0M8M:zbs6pD1WvxzUju1jahILIsNP0vM
TLSH
T14CE20B3B680CCB7E4F841E5CEC2AAF976DD801CBAB54899447FA484C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 1KB
SHA256 b0c101f5084dd412837f8842f21b628ba93f7af19b7005c5a6ebc93899cfe0ad
MD5 68b28f800befd4f26a02f3ecfc73b328
SHA1 bc5393d34d66acdfef0e5256dd66bf386ad191f1
SHA512 4bc1f2f1b5a5e4c685eebe9a0fe89eb2e4e3f0c6c1b15c80366ce809732a49206150ca9906279aa679c3fa2501d9e25ffcb391c3d224473c54b7ccd6f66e4702
TLSH
T15831204D9EA089CFE8A080B21572B5A4737198DC4B26B3135C2C32367E633592A475DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf0c0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe5cf0c0.TMP
Size 1KB
SHA256 3225dd4484d2f36f26ca30002414a41c5368202d07fb1f4c18700d5cc8968db7
MD5 bca885d5535f0031776f3d27835c8ac4
SHA1 b9549ed412ee7195e9a9cd9b6e2e1591d2f37535
SHA512 3a3381aaf3f4984317baf5e62719fa5d77dae67be92ade0105b141893c4f856c65392b64790e50e6edb015ced9bd646a039c7f7a21cb4ade28ef95596801a5b4
TLSH
T1AA31024A4AD18D0BE8C4507B1963B8F8733589409315B393A97C62399D21B8D1A4F0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5e89d4692c67b50e7e91347daac8a84834732d7a93d098172ed0fcf7d953b84a
MD5 cc5d45cea5dd1d7fcfc0c9d556e4aa65
SHA1 35d841b04c4b65b0ef76912a6dc3c218b36a412b
SHA512 e4886d00897430be31a7282d274cac455678923d80523324ed61fc7bb71131fbe89695f064cb8c095e0172f114ad1983cec432459ad5ab15052f143f6728f7ce
TLSH
T19EE0D8BB6EA76820ED6FE3E7247054750142385CC805BC4F546E96D350B13557846C65
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 345719ae64faf72699de30b3cd9ac84b090a11879577722f6732499e3e63f258
MD5 452421d363733a7eb64d2f0121be8a8e
SHA1 63fd05a3e0dfe06b570fceed7b0b3a0d5a33679f
SHA512 ce2e14716b550543881629bddec23027dda6a603d66ef2abae46052e33b652ae80b8421a5bcf8df6d96d91e927910fd6c5ee77a70d400b6b7e45616c0b90980d
SSDEEP 96:KUAAKtePGhOKy46CK8K/aMHeKIoWKqsKHq7:ii1Z3CN/s
TLSH
T1D2E17D4272BB02123C7E690C929987275F4277633414E42B7BA850F24E7AE381DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593704.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593704.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8f0c1be15515cb92451d5208dea5ff7fd96b95403fdd7db80881b3ccf7eb8f55
MD5 94be0ad43bba8a419ddaed41042f9bd0
SHA1 40d72c4fa32b6b4df4d03daf706933ee61613098
SHA512 49338f3b2653daf7c9e060d0769c35283a774ae9398c5c6244e1e32d82d9e0f0a1afa9201933a08a0d7346bc39878a5529c7e14f377ce30e6cfc66c308320d46
SSDEEP 384:3iFMZcI1UsN58TUNTUlIlvouvuOaa9pd13S8eoBSKS8j+5:yFamiwgGu/bba8ewSP5
TLSH
T10ED24BF248E79836D8AE5B47E77E2D174DBCC067B5846A80B7D88A0CCC9617FC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 2411cc65b9fcc65da77d08dadebd2db2fa0d15562424922b1617d0849582dd69
MD5 f4bca82f42a9618ba5c7ad2050ac71c5
SHA1 882f5ca4b80f63d7b656e1e36c71d3c1b88a4fae
SHA512 b846e15aa0caaa3d8a9782445c4640921ca2f8dc4527fad9a08947afcd2d4e5844dfb705ec368c483bad4cbb1b24f8f7b5911a48dfb41c8f376f6a7428a17505
SSDEEP 384:3iFiZcI1zsNa8TUNTUlIlTouvKVaa9pd128eoBSKS8j+5:yFQN7wgWuKbbO8ewSP5
TLSH
T10EA27C324C689C7BA9F7A948F98B32178EF58177D9D57B90A7DCDE0C00EB5A81306D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0d34d65b938bd0d4f3d9657b5c156c0cf6907776aa561c01c9409ec989cdc218
MD5 226173ce4910f0d4adc328933ac0c0b1
SHA1 26c4545bf719b9b8deddd1766d7c77b5b5e97e8e
SHA512 db0c8a21c7da74d212cf49df8aec22cbc583d428e923185986f19c81a8a6a920a53456282ee059c79e2b049acd0ad8a2d5e0e60d6e01ef4186867bacac2d4e34
SSDEEP 384:oZcIhsN5UzouvKrma9pd1k8eoBSKS8j+5:WhKu0HbM8ewSP5
TLSH
T1F2928D315C386C6658F7B449F98B35174EF4817BEAD83F80AAEDDF1C01EA5A81316D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 17d8fe275e161caab961afe2a2c55cabeb6a6ca35a0f1fc725998b811e9b67ce
MD5 62edff85c21d5bffbe249ad9b7147376
SHA1 23fe066b9a47381f49f6bf4100a1a643d549c422
SHA512 2b8875ee265a243fa6e5a4d9f822d0efb03e34aa0abb3ef24450cfb3fac546271024db5705d7f52bf919d91a1dd79146e62f86296cc274420962772a1ef27175
SSDEEP 384:0ZcIhsN5UTouvK2n2a9pd1k8eoBSKS8j+5:yh6utn3bM8ewSP5
TLSH
T10D928D315C386C6658F7B449F98735174EF4813BEAD93F80AAEDDF1C01EA9A81316D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f5aebf8b361cb3c5dc0e8adcd8b5dee53022af25cbe2e75780b49e76f1c5f5dd
MD5 063ed8c34507f72bfaf458b23874e0a6
SHA1 416dd8198ad445ea5542fd73289f7d76862d8cb8
SHA512 da1dc4e842bd2fb1d14a8aa2995d595d3e77d21273d34b5a23a9935a4977c60891905e97861a57eba5cfa7abcb2d6f5295c821cb87f6e33c3b88481c7ed19f62
SSDEEP 192:qON66O7+3hQmiUyUgGttb0/+Fd1DgGxiU6:qON661YGt9pd1HoU6
TLSH
T1F002F7396C782CA78EF2AD49F68737175FA5117BE9A62F40DAE85E0C00D765C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 88a711fc0d18e7eb6943e10d1ebf793906907f298ff11dfd5bb2440fc1ce75ce
MD5 195331d997713547fd0667a78962a965
SHA1 6dec97d7f53c43dba019d76a98c7c5e600030478
SHA512 8cea94c76b6f4d6331f6282943d6df40a1bb211c12eaf90702384f1902a7410b9bab9c67ce7404e3ded331008e23199338876c00a16f7489faf8edc9d2c67940
SSDEEP 192:WONb6O7+3JQmiUyGgyttb0/+Fd15GxcNdqimU6:WONb698yt9pd138U6
TLSH
T1EB1219357878AC675EA2A445F5C732178EA5417BDE8A3F80D9EC5E0C01EF5AC2347923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2ee04b99a6c98a501cb83b88a8e167448311d3dc2066c6a483c1fbdb8aceb86d
MD5 deb00b61825b6c901899de1e4b6c56f7
SHA1 b2b69aa6d2e151b2680181b8dfc57ed19a47d8a6
SHA512 201e3c10b68c33b106265c263ebbbcf8ca4fc627e5e17925de1800b9f0ef23775da22b31d21c13c8048d11ceca6e1d9d3ad47218b0ab79242ca9312877e139e9
TLSH
T11DE00156530102F9C12853B544571F602ED3902102E1020D4B70016D3C333267E31E91
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ed381908a1ae5c5a6a7b9b378647680118329cc816555ab455f6579a2f084676
MD5 79b81ca51c006dbcd3dfc6c3a7105994
SHA1 2211d6e476ac64da091bef2ae033ddba84665d85
SHA512 3557f65e35c1a3dc4a3880d98aa6423b139ae440b0b2128f7e337fed4f0a7f946f377d67228cac1b6ebc3b94c0165773df5ecc8ccc21982cc8dddb3b891d9e2a
TLSH
T182E00956934502AAC12853B544971F203FE6902107B2030A4B70026D3C333263E21B92
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 aca3bcaf9e8cdd72d4aed1af710db00056d171d719d5a9569ac1a70cc5a45464
MD5 1afa076a4b9bc8821f818e7ec0b90f5c
SHA1 425ee19b1171e8da0ac943ee0cf09ae33e3e358b
SHA512 9c25964d222ec73d2afd28072152f8e48a88b64db0b35d703012b0a87a2e641047d2a9c8fea17953e8abea85b0018b088f28be8dfda9ee40e3478f828b56ad86
TLSH
T1DEE00956934502EAC12853B544D75F203FE7902107B2030A8F70066D3C333263E21B92
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58d712.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58d712.TMP
Size 392B
SHA256 7c3c28b2dbb01364c0d5633b928d713e4b35d1c3aae774b5bd25554406443f10
MD5 87f5e992d947dadcf2a9b40e28d81761
SHA1 aca3ab4576c6aa3badb023fd82ed8c3418064fad
SHA512 f29e55fb06aaee41d6b2c2e04cc91cf942c6e8068f3567c2b24617c1c6d3b275612295c1c25316d09a536a4182454ca15b479e58bb698bb7dbc28b06f0777b62
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5c05dcf494aaef8bea2e449490eff7695fd635b4aae624acefbadeedd9925cb4
MD5 f1731083ed57ca1516f70d193b38d35e
SHA1 1c129068dde8ed54c0d949a2259681afa1c258f0
SHA512 04c7c4a3056a69ce22070e1407c97d7d1990746d9720dbb441b2a7434ae584d4cee4c8aa4f83a9b7526f5c750d30e52c50a52a8e1c6872823ca1c9da4ed837ef
TLSH
T15441095DBAFA1148B3B77F56ABF6A86D487EB9372E06945E10010E0F0A27A40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 f79aa4477008229208cd5c0d529e7e90f10ff2bf06219593b9c05d4586788726
MD5 e3c16e2b57b9d31c6ecaf3b433aaf3f0
SHA1 4368479f5c418ab728dc44a3fe9a4ad491a53668
SHA512 b17a9f8337c165f8e31eef70f60a1240034deebc1c2abfffad1dc2a47643b5a87d803d6374a3627bc79a2326cbb23ea1c6008542bded5fac3f70a0bc2aeb3cf8
SSDEEP 192:LIdkmsw7nIdkJGAw7nRdke8b+dvdk5wEqdkBIwP:8dkmsGIdk1GRdke8aNdk58dkeA
TLSH
T11C320111ABE92616F2F7DEB2E9B33711EF77B9155A049A0D008096090CA3B04D97EF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 8KB
SHA256 aa53273c3132ea59af22b597c96fc17fdb241b17cac1b4ef07598bb231e2faff
MD5 a3608ff254265761a299363e573bfc42
SHA1 6abf7685406cfaa73999efbc2c33e657591ed7f3
SHA512 9b90e153811b9310d3c428aac4d456e92d570ab6890c8a5935ac17698aa004f88d350a5529d1c2b769cfacd06206e00e6926eaabf8a36364b5925015671c487f
SSDEEP 96:Q/rkJ9skElQgu9w8BdkJxO6Hu9+7WdkJru9IDLdkJnIu9P:Wkw1Qgww2dk+yw+Sdk5w6dkBIwP
TLSH
T1AA020011ABEA2756F2F2DEB1E9737B10EF77B8055A045A0D008095090CB3B0499BEFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 fd458430beae18c3fffd8bd274087d670556d87c2afd01636781573026fd2bd4
MD5 48fed83a0ddaf00131e53bd9219ed578
SHA1 9db1df67ea717e288d9079a520ca0dfcd5788ec4
SHA512 a3d33ccaa73ef5d19892ced518c5cb71b6214a0c7d3facdb80d7b293f36fb3aca1776ed9bdfc81790fef580c7d53aea5b04d50cb87f8c8871984c46feaa9d6a8
SSDEEP 192:P1dke8b+aEdkw1QgwwmEdk+yw+hbdk5wAmdkBIwP:P1dke8aaEdkw1QgLmEdk5Vhbdk5Nmdk1
TLSH
T190320011ABEA2656F2F6DEB2E9B33710EF77B8455A045A0D008095091CB3B04D9BEF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 a2574c4d5665907f46ec6f1831069d2630b464d180a968285efcdc31b5cd6ee3
MD5 d4a3184ca75556a06fd6c668094cf3b8
SHA1 9c0b73376ba4782a6de026321194b47acd70ea69
SHA512 0545f2cfb94e6f8aacca98149200101618f5d894bc9612ceee14871835925596f85111186c0018b2aa5bc01f779d0a4d9a5e5c885b44b9ee2e86ed94446e7249
SSDEEP 192:kdkJGAw7hdke8b+1dkw1QgwwJdk5wFdkBIwP:kdk1Ghdke8a1dkw1QgLJdk5EdkeA
TLSH
T1A032F051ABED2616F2F6DEB2A9B32710EF77B9055A045A0D008095091CB3B04D9BEF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

achievements.ini

Path C:\Users\Public\Documents\Steam\RUNE\4421010\achievements.ini
Size 32B
SHA256 bd583fdedda922bfc385b7872db9329d4d61c4548852fa8207ebe72b5af8eb2e
MD5 7ebba17ad01ef8b82fe01c5a15a31634
SHA1 29f8ac51d89a7d3f300e765685f5230edb0c9752
SHA512 05bdb5e1d7e4429c0b33b13fd29f43b92d174260480348e12fb3dbe0f603dc44146db142cbf3bbc5ef09e6f7d86a269abba15d4ce0a80bffa9c38e31af33e04e
MD5 SHA1 SHA512

Submit Download

leaderboards.ini

Path C:\Users\Public\Documents\Steam\RUNE\4421010\leaderboards.ini
Size 32B
SHA256 749be0285d916625e06e0b5273889c2ede421b1f16f765cf817870fcec8c2930
MD5 d03f6a84b07a97dd09a27efb9acd8d1d
SHA1 3e27d5f859bdd0822dfacdb5510ee88dd2834496
SHA512 659db10eb03cb17a4dea5190889d9723a7a7cb705b11685f5912f3ea667375ae2502e5c6101b07687ef48f03902e9b1fa890c9e328947626528dca485a21018a
MD5 SHA1 SHA512

Submit Download

memory/3484-967-0x000001CBFF3C0000-0x000001CBFF6AC000-memory.dmp

Download

memory/3484-979-0x000001CBFF3C0000-0x000001CBFF6AC000-memory.dmp

Download

memory/3484-964-0x000001CBFF3C0000-0x000001CBFF6AC000-memory.dmp

Download

memory/5028-888-0x000001ED9A190000-0x000001ED9A191000-memory.dmp

Download

memory/5028-887-0x000001ED9A190000-0x000001ED9A191000-memory.dmp

Download

memory/5028-886-0x000001ED9A190000-0x000001ED9A191000-memory.dmp

Download

memory/5028-895-0x000001EE916E0000-0x000001EE919CC000-memory.dmp

Download

memory/5028-884-0x000001ED9A190000-0x000001ED9A191000-memory.dmp

Download

memory/5028-882-0x000001ED9A190000-0x000001ED9A191000-memory.dmp

Download

memory/5028-885-0x000001ED9A190000-0x000001ED9A191000-memory.dmp

Download

memory/5028-876-0x000001ED9A190000-0x000001ED9A191000-memory.dmp

Download

memory/5028-877-0x000001ED9A190000-0x000001ED9A191000-memory.dmp

Download

memory/5028-883-0x000001ED9A190000-0x000001ED9A191000-memory.dmp

Download

memory/5028-894-0x000001EE916E0000-0x000001EE919CC000-memory.dmp

Download

memory/5028-878-0x000001ED9A190000-0x000001ED9A191000-memory.dmp

Download