Analysis
- user interaction
yes - max time kernel
313s - max time network
433s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
08/09/2026, 20:00
General
- Target https://steamunlocked.org/states-of-power-free-download/
- Sample260908-yrbrfaxtas
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks SCSI registry key(s) 3 TTPs 62 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 5 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies data under HKEY_USERS 7 IoCs
- Modifies registry class 64 IoCs
- NTFS ADS 7 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs
- Suspicious use of AdjustPrivilegeToken 40 IoCs
- Suspicious use of FindShellTrayWindow 64 IoCs
- Suspicious use of SendNotifyMessage 64 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://steamunlocked.org/states-of-power-free-download/1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x29c,0x7ffd26e9c188,0x7ffd26e9c194,0x7ffd26e9c1a02⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1696,i,3881753032175379377,16239577181538373973,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:112⤵
- System Time Discovery
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,18120270650732370477,3865739915444391599,262144 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,10446988035911460330,14162804977415495309,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:132⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,11031112054534321298,7617133690942452596,2097152 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,5779455471474617473,9361428430690860534,2097152 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,2235729823978520948,2051434028971587137,2097152 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,15692941924901031692,10366132721244362422,2097152 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4284,i,10995543343715158177,9056042257581275971,2097152 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4300,i,11612500926875343140,4596303709411726712,2097152 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:92⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,429305447212425377,1573747798483791984,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,4476730960674896504,14856662675800924380,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,11062116539732953401,15309134391190571654,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,11062116539732953401,15309134391190571654,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,885359239566884507,8111592861688229865,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:142⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.execookie_exporter.exe --cookie-json=11283⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6140,i,10260561931940266075,11088014079633838539,2097152 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6724,i,16867840687564849448,14931034695363324979,2097152 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6852,i,10682621888018509749,15272515981915880264,2097152 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6844,i,11489826498123474413,13693766605608457829,2097152 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,7466956367953282791,9264120177297537930,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,7466956367953282791,9264120177297537930,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6608,i,17923780301527380402,3070071151974658410,2097152 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7208,i,17420817890112879833,2675664376643835359,2097152 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,13903420016664212503,5655926595054634890,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4564,i,10686935802244074918,10158228151191676419,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,11737037975535156661,15918697920243140732,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7380,i,10901974791218516318,10803435898312566626,2097152 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4740,i,15073983405575609319,8114944188369985161,2097152 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,4371569911022491371,6576694238473772269,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:122⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7532,i,6820767946251005408,11270056639604330557,2097152 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,9176737844508121804,5195793960086324965,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=2192,i,15799878657688263932,9342771540045057919,2097152 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,3494680873186962876,17223406549764389794,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5636,i,7346729357487625482,13560394842046274494,262144 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:102⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,1209357284547062522,17171639517411085992,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,5738822108537165940,8814634513315035079,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7484,i,4817847159082320558,11244106327161214075,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3972,i,2727250684490647800,5923431207328489672,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:142⤵
- NTFS ADS
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,12884612700352543156,10364491978317919523,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,770434674757396749,13831744387166226776,524288 --field-trial-handle=2328,i,1495655266750666939,3549144274667743162,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:142⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Downloads\States.of.Power\States.of.Power\game\sop.exe"C:\Users\Admin\Downloads\States.of.Power\States.of.Power\game\sop.exe"3⤵
-
C:\Users\Admin\Downloads\States.of.Power\States.of.Power\game\sop.exeC:\Users\Admin\Downloads\States.of.Power\States.of.Power\game\sop.exe4⤵
-
C:\Users\Admin\Downloads\States.of.Power\States.of.Power\game\sop.exeC:\Users\Admin\Downloads\States.of.Power\States.of.Power\game\sop.exe --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Roaming\statesofpower /prefetch:4 --no-rate-limit --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Roaming\statesofpower\Crashpad --url=https://f.a.k/e --annotation=_productName=statesofpower --annotation=_version=1.0.0 --annotation=plat=Win64 --annotation=prod=Electron --annotation=ver=39.2.7 --initial-client-data=0x50c,0x514,0x518,0x4e8,0x51c,0x7ff6e08b16ec,0x7ff6e08b16f8,0x7ff6e08b17085⤵
-
-
C:\Users\Admin\Downloads\States.of.Power\States.of.Power\game\sop.exe"C:\Users\Admin\Downloads\States.of.Power\States.of.Power\game\sop.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\statesofpower" --standard-schemes=sop --enable-sandbox --secure-schemes=sop,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sop,sentry-ipc --fetch-schemes=sop,sentry-ipc --streaming-schemes=sop --field-trial-handle=2660,i,4161503735077588627,5337797383378498097,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2648 /prefetch:115⤵
-
-
C:\Users\Admin\Downloads\States.of.Power\States.of.Power\game\sop.exe"C:\Users\Admin\Downloads\States.of.Power\States.of.Power\game\sop.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\statesofpower" --standard-schemes=sop --enable-sandbox --secure-schemes=sop,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sop,sentry-ipc --fetch-schemes=sop,sentry-ipc --streaming-schemes=sop --app-path="C:\Users\Admin\Downloads\States.of.Power\States.of.Power\game\resources\app.asar" --enable-sandbox --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2660,i,4161503735077588627,5337797383378498097,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=2832 /prefetch:15⤵
-
-
C:\Users\Admin\Downloads\States.of.Power\States.of.Power\game\sop.exe"C:\Users\Admin\Downloads\States.of.Power\States.of.Power\game\sop.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --video-capture-use-gpu-memory-buffer --user-data-dir="C:\Users\Admin\AppData\Roaming\statesofpower" --standard-schemes=sop --enable-sandbox --secure-schemes=sop,sentry-ipc --bypasscsp-schemes=sentry-ipc --cors-schemes=sop,sentry-ipc --fetch-schemes=sop,sentry-ipc --streaming-schemes=sop --field-trial-handle=2660,i,4161503735077588627,5337797383378498097,262144 --enable-features=DocumentPolicyIncludeJSCallStacksInCrashReports,EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=4016 /prefetch:125⤵
-
-
-
C:\Users\Admin\Downloads\States.of.Power\States.of.Power\game\sop.exe"C:\Users\Admin\Downloads\States.of.Power\States.of.Power\game\sop.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\statesofpower" --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1824,i,10462786363519640975,13504171483405919890,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1792 /prefetch:24⤵
-
-
C:\Users\Admin\Downloads\States.of.Power\States.of.Power\game\sop.exe"C:\Users\Admin\Downloads\States.of.Power\States.of.Power\game\sop.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\statesofpower" --field-trial-handle=1824,i,10462786363519640975,13504171483405919890,262144 --enable-features=EnableTransparentHwndEnlargement,PdfUseShowSaveFilePicker --disable-features=LocalNetworkAccessChecks,ScreenAIOCREnabled,SpareRendererForSitePerProcess,TraceSiteInstanceGetProcessCreation --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=1848 /prefetch:114⤵
-
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
81d859a5-8e4b-4ce7-91eb-cc6154049d5d.tmp
blocklist
settings.dat
settings.dat
LOG.old
LOG.old
BookmarkMergedSurfaceOrdering
f_0000a0
the-real-index
the-real-index~RFe592774.TMP
SiteList-Enterprise.json
Edge Profile.ico
Network Persistent State
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Preferences
Preferences
Secure Preferences
the-real-index
the-real-index
index.txt
the-real-index
the-real-index~RFe58d2cc.TMP
sync_diagnostic.log
CURRENT
OperationConfig
OperationConfig~RFe593d4d.TMP
Local State
Local State
Local State
Local State
Local State
Local State
RevisitationBloomfilter
RevisitationBloomfilter~RFe58d57b.TMP
metadata.json
iconcache_idx.db
microsoftwindows.client[1].xml
default.dic
f01b4d95cf55d32a.automaticDestinations-ms
Local State
MANIFEST-000001
States.of.Power.zip:Zone.Identifier
dotNetFx40_Full_setup.exe
dxwebsetup.exe
oalinst.exe
vcredist_2015-2019_x64.exe
vcredist_2015-2019_x86.exe
vcredist_x64.exe
vcredist_x86.exe
chrome_100_percent.pak
chrome_200_percent.pak
chrome_200_percent.pak:Zone.Identifier
d3dcompiler_47.dll
dxcompiler.dll
dxil.dll
icudtl.dat
libEGL.dll
libGLESv2.dll
en-US.pak
resources.pak
app.asar
airAttack.png
morale.png
waterAttack.png
norway_modern.png
thailand_modern.png
004c201bd63f7cf1a43c.png
0136e63814b3dcf61440.png
01489d165d5f1ec3f591.png
01ff5b0d4d212318a764.png
02bdb62f6484105a3982.png
02d28b801f67ae30c4d8.png
057fb0a7a4a4b9a25fe5.png
05ebec053d2c1cdc58a3.png
06ddabaeb94436735122.png
0853f0f86ffa16b761bd.png
0860d69bcbefb8a66ffe.png
099c420e3dcded686b8a.png
09d6e8a70b60e36e6ba5.png
0be43910e643753ba5c5.png
0c2399eb050bbd9b15ab.png
0cb52688ee788ba0f4ef.png
0d60c299e8c639fb5d45.png
0d8c511266980125133a.png
0d93e6083ab9e31d8262.png
0e0259785678798020f0.png
0eebdba81a4f40453d50.png
1018293e987a9dc64fac.png
101cde0c5f45d99c43af.png
104b5ed58b8f1d11f469.png
11524adc74f65e17e122.png
136780fac3c6db2d9c51.png
1712cb7cd09da89daf4e.png
192c8cdd0c1962f28e1f.png
1941c0d4f53f7cbc4fc8.png
19f45d0ba6ede93010e4.png
1a99a6a0efb0583767aa.png
1adc5a02962a0123444b.png
1c4b50008d1c944c10a8.png
1d24a8a88715093b562f.png
1d5aa6666ca7c177939b.png
1e457e8fb97de722cf2e.png
1edc70b2386db946cb82.png
1f966870f49eb930d59d.png
1fdc0c3a7ee254c8f54b.png
202207c2c451ad5908ee.png
208837507e157e324cac.png
210f8532316aabbbaa24.png
2225c53dcfc8cbc586bd.png
229091d24b0f3a04ca74.png
2330fc6b91600a3f8609.png
233146dacf7c99ac3779.png
2474692ab42f6f0223ff.png
24856cd76e545a32599e.png
2568b65e8e4cb14e3967.png
257999122376597d021f.png
2589326950ca6a3dadb0.png
2589356fe85bdf04bc95.png
2616a84d4381bbc7eb08.png
261985295d16a385ce30.png
26c6d22e4415cd7c4154.png
27aad71c5dfa64500431.png
290d4ad38dc31e3cb50b.png
29909400e6d2629c4aba.png
29dbc597fa755254586f.png
2a00ed80e89ffc6f41e6.png
2a9f3d2ce69d6fcac014.png
2aceab19ad4a21708d5d.png
2b35d9f730f7c1e83d88.png
2cf185d17e133ee6521c.png
2d217abbc15b04ff460b.png
2d646e4ab385674ff880.png
2ed589fe7161e6284f74.png
2f93502a7af43fc7aac4.png
2fad40782a4b4cfef658.png
2fbddad6111a66b3b334.png
300373e593b195bbe74c.png
304596c87cb0cb404078.png
31ff568a1012438228c2.png
3214c36c5f56ac954f42.png
32f170f4af5882a0bf49.png
33123d3de77f08b01326.png
336169e9fd0658e4bd95.png
3391bc06b54eeadc00ae.png
339b88d6ee322ad7e8a8.png
33f62336671709a104ee.png
340dd0ec1c5bf3d6e910.png
345f1b0a8097946b4bfe.png
3539a4cb2b840b9e8e8f.png
36731e88631203b0a1d2.png
36f75a731ad06040769e.png
36fa13c9e53b99c7bf67.png
37a31b91636bb534481e.png
37b6d415af03d2c0b650.png
37eb704fa30c79eb77cf.png
37eb7b2217347d91882c.png
380138a0455998147efc.png
38153eed7f155a79e230.png
3836812e4b6469828631.png
385870065387625e83c8.png
38dfab0c88065fca260e.png
396d5088d8b5e0646d87.png
3992b38fd057fdb00a86.png
39bb344e6596c0be309b.png
39f7205c6334940ddcbe.png
3a1b66bfa13e575b8fce.png
3b001c6d633b6d07ff17.png
3b228ed2efdb289ca5e3.png
3b65da5b31f6b1c50b26.png
3babba48911cd5492947.png
3c15cdac1a58156b33e1.png
3dd50b7e5784b29fa156.png
3e50902e8f6240188ac9.png
3e65a2644c15fcd3ed42.png
3eace406df75ebdb9df9.png
40191dd3257951567db8.png
401abbe3b1d8a66887ae.png
408653e7f79aa1eefe39.png
41ee484f11df8b706860.png
42d526f90b603e14979c.png
4363f7bcf895ffbf5bcd.png
44654eb4590eff2737ef.png
45c1a927635108a970e6.png
46c505c0d76f873e9b63.png
46cf9ad693c5464a925d.png
4733e3661b15e3b70745.png
4753df2a13c75afb6b86.png
47da6ee3e668b602272e.png
480fb086f2a2ff25d843.png
484505db1a0f537a8831.png
4851ce40d2cfde95fe0d.png
48b23c17c40cfc7f5ce1.png
48de3d70c8c3bf41766f.png
4a661ccd6fb63e2a4a73.png
4a675fe8ef59a277ff32.png
4a9c84f1e2a2177c629e.png
4b264d3ed98fdfb92bfc.png
4bd923e59c5dba7a656d.png
4d0b9127741373547e6c.png
4d9d10ac36db703af930.png
4dabf08b16d1029b33a3.png
4e0346cdba6f005b93ed.png
4e060dfa4879acfe44d5.png
4e64fcf3a1990279efd1.png
4f7178b75726c283f791.png
505fca5ad160af92f84b.png
507300a61045bfa0c53e.png
52efde413d3f5a24baeb.png
53935189eb7cf80f02f2.png
54ca744b9f5f9ac69ce1.png
54d0842401f7cba58c9f.png
5652ffe3e1b819c472e0.png
57801f83c28fe2040fe2.png
58e56180d7e9bf2d634c.png
59a455911832cf859e5d.png
5b08d2b9f2ca91080aa8.png
5b42be8f47e3dab03d98.png
5c60061deca9fdfd48fa.png
5c734405ed6f38f1f788.png
5d0ad86d706b8f2ca8e1.png
5d277530ac3c3bba59ad.png
5d43fc02e29ab66008c8.png
5d48bcff955922bef6a2.png
5d6ed4e2ee7344c0657e.png
5d7fb956f9f84fb59777.png
5ec6f9a16917ccf91b9f.png
5f6b245232d3c30b57f4.png
5fede09d63e9f3ac65e8.png
5fee98866e8dac743c21.png
602830a12810108c68a2.png
6033d461fc3841f1f248.png
6043ea85dedcd94ba7fc.png
609d8abd04e022a19ed2.png
610406de1b7e424af0dd.png
624ce69d0acfc5cfb920.png
62c1014d14f094c825ac.png
631f729d90e7d675b14a.png
643afb2d1455eee4b0a4.png
660b305e4853c8d3b100.png
67855b82c25c24dd876c.png
679b5aee5eb1a97568ce.png
6939befe6ec4bd1b1ded.png
6b482bd079a903a55d78.png
6c9350904cd4c3d4ee9b.png
6cc3baa3d6d674049138.png
6cd2ba42fc14451195bf.png
6d207df9bf6d2e56c528.png
6ea74c02662c7cb97fe4.png
6ff192b80a87937d57ca.png
712c47afcc2a2592fbdd.png
7145e4b6627fea43d04f.png
726031442b4fa9eb5d9d.png
72a09d877d5249fe26bb.png
74003d3ab022a7a42fdc.png
7595b73a7abbf768e59b.png
7819a8139d58cab4011d.png
79295e0756f0f88f7f66.png
7a23c924ef8a9371e0ec.png
7a337665bc5b765e5529.png
7b31ed4ddf649a148146.png
7ba817165869df96d471.png
7c3d1e31cca45ba3fcb3.png
7cc2389f91079a3dbc81.png
7d105017d414bf4e56b9.png
7dd8183e201a858d31d2.png
7f22e7b8141b5497baa1.png
80e7eae569e6895bbe8b.png
82e1ce04e1ed233a4443.png
835ad79303d2623b4f8a.png
849f1d47996be0a5ac34.png
85df49499626f69602d5.png
86160f3acb9e07f97670.png
86773efd15778f427509.png
868751e93cf8b76b585b.png
871c26b6e38208c13cca.png
8754f7549ff1eb9c3215.png
87d58f002e5e24edcac1.png
8831f50ab3feaba7d835.png
88c48cf7a16601b695c6.png
88cee5a6fb7234b36a39.png
89c14c0bf7ef3d8bb792.png
8a0b852465482d3d3eb4.png
8a0e2c1aa7821f56b14e.png
8a3dce140bdff74ffe13.png
8aaac179264ef3e58cef.png
8ddb8a5781319d93ac76.png
8df594aa80fd6db7a40e.png
8e423798b4edd345b789.png
8ec21a274f892a863578.png
8f1d7db6ae113c06faa6.png
90a2d4f6f6a1b24f5455.png
915899c697d5ca908ddc.png
93e87c94b78df051cb4f.png
9437d5fca8c1b80253d0.png
94a082b7a14271ed4954.png
955133701dcf3ea4148c.png
961024f11cb664024e86.png
970ac165d6a755d0bd7b.png
9811c62210595782df74.png
984b2035247ebde77391.png
99557459d5601a9ae65d.png
99781d9d4523be8357a7.png
99e004d31f8690a65b80.png
99fd39a7153b19ef9e79.png
9a016c71b823a81d64ce.png
9a50cec95bf1b11ddc97.png
9b2b862ce35fae6ec32f.png
9ba656015c6fdd54e225.png
9c351d2f2a5f33e98d46.png
9c37a40b1a9acc8428d9.png
9cebf592b9e9a4dd847f.png
9d07cc58c7074c5a6d21.png
9d402f976ca80cb452c5.png
9d737c872006e2a270a2.png
9d7ba1b7c68295aa34b0.png
9e98bb3b7438d8975be7.png
9eeb7bfdf70305c5abb3.png
9f9978f1bcf051ce37d2.png
a03cd22fc63586c4cc9e.png
a171cc5ff5d3405424fd.png
a1c18cab187c3a7f1d6b.png
a1d0fec99a889ab9d67d.png
a4bb3fb1e5fe1f559691.png
a76a8da36c5a02130a9d.png
a7d6f5934e7fbb07fab5.png
a9246277d095fa430bea.png
aa63335b0b3ab960c96e.png
ab1256c013b8cea27d21.png
ad3873ead8ff8e1d5dd5.png
ae179840374427c1b41a.png
ae63221b9e7fd274367b.png
aec15c4c4345966cb0e7.png
af18322cffb05bb055ed.png
b0ee2b9d437ce493be9f.png
b131a8c982d2f9302d07.png
b2c1441c29f2de298ff8.png
b3406f3e893b049ea8e9.png
b36cdca065af622bd3b3.png
b42683e27ce058a8e7f6.png
b5470b86fd80d08b3b45.png
b56d455867681a5ddc67.png
b5d0579a239c172ffe54.png
b632d5c208298f6afedb.png
b81c4254c7cd1c97cffa.png
b82fdcefb0a744e916fa.png
b8acedc13f94f0678217.png
b9e3de2441905e322451.png
ba022c234d423e8c118a.png
ba6e9edd90697cf43eef.png
bbec2e6756cb738707c6.png
bd162757761816d86c1c.png
bf672e525f9598de669e.png
bfb2bc88da562e931487.png
bfcb53e6ae50eb82cfaa.png
bfdef7288884c8f6a40b.png
c0129d975f7ee5d042d1.png
c1fb9f5d0a5d6db95900.png
c4bab5798a85873ec766.png
c5e6e20c80d5ab0988ed.png
c62ae9f272d40245b8cb.png
c6950dfba5811890c42a.png
c6a7be8845e37153e1e1.png
c705586c533acb7e43fe.png
c744379426c83ba01ce2.png
c87f31f717340315eee7.png
c95f2bf45d03fadbc932.png
c9acdcbb848553e6d6b7.png
ca6dc9dd78d7e818e748.png
cb050b543b8720ba8325.png
cb86ab15a74197025bf3.png
cb886de021f0b0af9c46.png
cc4b88e769247c1fd256.png
cc92d84785107257a0f8.png
cd15e5ec532a9b54259d.png
cd87849fa0fcb3892021.png
cdccb0fdc83e081c433a.png
cf5acade3034665cc84e.png
cfd8edea9fb545d433a1.png
d0023d182463e60a01a2.png
d05612f457c12c5bba71.png
d0bebe5fee2e2e3a446a.png
d1a6345aae62abed4a32.png
d217560f80942fd775e5.png
d35e22b75187bf18ac39.png
d42f2f2b176d982b098f.png
d4b51f736735ab9cc482.png
d4e5447f563b1309a5fc.png
d520617a271e6f9a22fe.png
d52ddf23dfae5106f4c6.png
d53ef5a6ecd79a624918.png
d5cb51f95f9c8d0dcb09.png
d5cdf4a8339ece9606b7.png
d648c866a22ea99e7d1f.png
d6c4d76d6a73a32cdf7b.png
d748bdf098a9ce2c78a6.png
d7550627c78c7597a90f.png
d81c9cdba31f7fd7b20f.png
d821757cac28f1e09d0f.png
da1ebbed44091d0dd317.png
da3e44053dde61595664.png
db9404ced620c4b75c3b.png
dc128319229cfff70c4a.png
dd5559bb512511b04942.png
dd6dfc5e91da4b20629d.png
dd7d373ccc67eeb335b7.png
de3f119ce57546aa4b80.png
de590f39d796c6316d62.png
de75c3f0aa08f0bd218d.png
de89208c6b6076488c51.png
debb17488415a67e19cb.png
e0961cb32c2fb1871c7c.png
e25d43b3927c9376cef9.png
e27fa18909c4008a3b09.png
e35db50f0b5e5517bf7f.png
e3657a62fe69d9e82405.png
e39a3351ca000817768f.png
e48b3d20e7bb15ec2028.png
e6a84b26fc486e52f58c.png
e6b730f5d1449da3ab87.png
e6fcd97cbb1aaabedc2a.png
e7674818f39559a5010c.png
e7a98fb103e3abfe1312.png
e811f8a759fcc55074ae.png
e8594505233edd204799.png
e99ea24856801dc0323e.png
e9e61e1192b02e66bdf7.png
eaa488fd0861e71e15d3.png
eb62b9df3b216e599aa8.png
ebecbe71f8acf305c485.png
ede31b76994a1a292c0b.png
eea485d3328d72e98320.png
ef5492d44d5ac347f4e8.png
ef5b20d043c4f44b268e.png
ef95765d043ecd3aea4b.png
f00919e733a8f77c4c20.png
f0b19303cc1a18a517a2.png
f115128bc83690eea927.png
f26eae0cd9d76f0e0055.png
f2a1cfb4c0804a140ada.png
f2cb372b60727102a1e3.png
f4fd4d2aa2de928e6d28.png
f50ce18073775cd8b4d5.png
f524007ed561694a80bb.png
f590c2d7aebfe40da435.png
f698f040b4115bf8f4e0.png
f6ea528061ebb737396e.png
f846b55659d6efa459c1.png
f9705e0ebd3e70885a4c.png
fa143506f8fd58ba0896.png
fa5d334e39533507ece6.png
fb6a2a46cd05a032f40e.png
fb79e2b2731983a7a25b.png
fbe0a7c600592011454b.png
fc3277bc2af16fc9f0b3.png
fce00c3e0a7203f6167b.png
fd0f8c107b63ca08792a.png
fd7861608ba4955f7ca4.png
ff44cb3336cde09792ed.png
ff593ad801aa04762288.png
v8_context_snapshot.bin
vk_swiftshader.dll
vk_swiftshader_icd.json
vulkan-1.dll
memory/3776-581-0x0000012BB4ED0000-0x0000012BB4EF0000-memory.dmp
memory/3776-582-0x0000012BB4F90000-0x0000012BB4FB0000-memory.dmp
memory/3776-563-0x0000012BB4E70000-0x0000012BB4E90000-memory.dmp
memory/3776-548-0x0000012BB4E50000-0x0000012BB4E70000-memory.dmp
memory/3776-522-0x0000012BA2960000-0x0000012BA2A60000-memory.dmp
memory/6092-7770-0x00007FFD451D0000-0x00007FFD451D1000-memory.dmp
memory/6092-7769-0x00007FFD44430000-0x00007FFD44431000-memory.dmp
memory/6092-7832-0x00000120B6BB0000-0x00000120B6C9A000-memory.dmp