29fe1f9f42113305beda91d6ef3a8f16fbc68b1ddeca5ee6f1b1f40df6c39cfc

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 00:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
pbirds_setup.exe
Size 15.3MB
Sample260910-a2falsvxdt
SHA256 29fe1f9f42113305beda91d6ef3a8f16fbc68b1ddeca5ee6f1b1f40df6c39cfc
MD5 9b6270e9739c46ffc78b892eb73980d7
SHA1 b107376381710685a0f1f30b057f7b2ccac9f766
SHA512 04932ec28cad411109c829e13373248c34ec9f323a4418d17db39a79b64c2e8658ddea64970d1d642e77757822010c2b2429072c5b0f74f7d0a4cabc8acc7a4e
SSDEEP 393216:MF5s7kvPHun1TjBYPJEkcAamEYVCUoB2MxNl3tJ:qssM1QexPuVCH0MR7
TLSH
T1AFF63343C0494E21F350573BDED2F0D54EEE5DA24A61F41DB484A28EDD0B6E3A2E7B98
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

adware discovery installer spyware stealer

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-AHO51.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage3\el\is-8CVP9.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\levels\arcade\is-NAHJ9.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\sound\is-MIA80.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\bird\is-F17N3.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\happy\is-53HDN.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\el\is-J9PES.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\is-VO9PM.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\is-UD4HA.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\el\is-3EA5F.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage3\is-BOHS1.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage3\el\is-SVGGB.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\interface\cursors\is-VJLQC.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\interface\cursors\is-8UOOA.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\is-GBRDF.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage4\el\is-AV0KI.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\buttons\is-J4S8K.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\fx\is-KL94U.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage4\is-0HUEC.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\sound\is-4TGKR.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\sound\is-MTL5L.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\install.lnk	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\font\is-2TNKH.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\interface\cursors\is-97CAU.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\is-S5GUD.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\is-JSRU9.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\stolb\is-VQ800.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\is-C9S9C.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-Q6QDL.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\bird\is-VQ0M8.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\is-ESUNL.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\el\is-SH4FU.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-618VO.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\levels\adventure\is-P9LE6.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\bird\is-RGUBL.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\happy\is-P0QIF.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\el\is-EM2F7.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage3\is-2T75L.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage3\el\is-7OO4K.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage4\el\is-BCU2M.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\levels\action\is-R2B4A.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\bird\is-RS7V3.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\help\is-H1U23.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\is-CCDHT.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\is-F67FI.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\el\is-PJ153.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage4\el\is-HG5G4.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\el\is-KF78M.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\el\is-0M92M.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-0U803.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\el\is-JS71K.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\el\is-ELFNH.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-3CP79.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\sound\is-LN26B.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\el\is-N4ULN.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage4\is-K8CLR.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage4\el\is-LFIDV.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\is-808HN.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\bird\is-4OSGH.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\el\is-SUTO0.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\el\is-5BCIV.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\el\is-F4C0A.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\levels\adventure\is-MQ12L.tmp	pbirds_setup.tmp
File created	C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\is-DIS1F.tmp	pbirds_setup.tmp

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_1976764075\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_1060370030\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2328_1060370030\protocols.json	msedge.exe

Executes dropped EXE 4 IoCs

pid	Process
4208	pbirds_setup.tmp
1768	Pestering Birds.exe
756	PreLoader.exe
1680	game.exe

Loads dropped DLL 3 IoCs

pid	Process
4208	pbirds_setup.tmp
4208	pbirds_setup.tmp
1680	game.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PreLoader.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	game.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pbirds_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	pbirds_setup.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Pestering Birds.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4392	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/memory/5536-1-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral2/memory/5536-24-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup
behavioral2/memory/5536-3027-0x0000000000400000-0x0000000000414000-memory.dmp	innosetup

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	PreLoader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	PreLoader.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Cache = e304000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	PreLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	PreLoader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\PreLoader.exe = "11001"	PreLoader.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\International\CpMRU	PreLoader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	PreLoader.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	PreLoader.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334745911269569"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{1CE3B9B4-990E-4325-9A64-F992010C1C53}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1680	game.exe
1680	game.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4208	pbirds_setup.tmp
2328	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
756	PreLoader.exe
756	PreLoader.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 5536 wrote to memory of 4208	5536	pbirds_setup.exe	88
PID 4208 wrote to memory of 2328	4208	pbirds_setup.tmp	91
PID 2328 wrote to memory of 3924	2328	msedge.exe	92
PID 2328 wrote to memory of 4836	2328	msedge.exe	93
PID 2328 wrote to memory of 4392	2328	msedge.exe	94
PID 2328 wrote to memory of 4836	2328	msedge.exe	93
PID 2328 wrote to memory of 4836	2328	msedge.exe	93
PID 2328 wrote to memory of 2088	2328	msedge.exe	95
PID 2328 wrote to memory of 2088	2328	msedge.exe	95
PID 2328 wrote to memory of 1416	2328	msedge.exe	97
PID 2328 wrote to memory of 3260	2328	msedge.exe	98
PID 2328 wrote to memory of 1416	2328	msedge.exe	97
PID 2328 wrote to memory of 1416	2328	msedge.exe	97
PID 2328 wrote to memory of 3260	2328	msedge.exe	98
PID 2328 wrote to memory of 3260	2328	msedge.exe	98
PID 2328 wrote to memory of 3928	2328	msedge.exe	101
PID 2328 wrote to memory of 4364	2328	msedge.exe	100
PID 2328 wrote to memory of 3928	2328	msedge.exe	101
PID 2328 wrote to memory of 3928	2328	msedge.exe	101
PID 2328 wrote to memory of 4364	2328	msedge.exe	100
PID 2328 wrote to memory of 4364	2328	msedge.exe	100
PID 2328 wrote to memory of 708	2328	msedge.exe	102
PID 2328 wrote to memory of 708	2328	msedge.exe	102
PID 2328 wrote to memory of 4164	2328	msedge.exe	103
PID 2328 wrote to memory of 1068	2328	msedge.exe	104
PID 2328 wrote to memory of 4164	2328	msedge.exe	103
PID 2328 wrote to memory of 1068	2328	msedge.exe	104
PID 2328 wrote to memory of 1324	2328	msedge.exe	106
PID 2328 wrote to memory of 3464	2328	msedge.exe	109
PID 2328 wrote to memory of 3464	2328	msedge.exe	109
PID 2328 wrote to memory of 2292	2328	msedge.exe	110
PID 2328 wrote to memory of 2292	2328	msedge.exe	110
PID 4208 wrote to memory of 1768	4208	pbirds_setup.tmp	112
PID 1768 wrote to memory of 756	1768	Pestering Birds.exe	113
PID 2328 wrote to memory of 1536	2328	msedge.exe	114
PID 2328 wrote to memory of 1536	2328	msedge.exe	114
PID 2328 wrote to memory of 1536	2328	msedge.exe	114
PID 756 wrote to memory of 1680	756	PreLoader.exe	115
PID 2328 wrote to memory of 4112	2328	msedge.exe	116
PID 2328 wrote to memory of 2980	2328	msedge.exe	117
PID 2328 wrote to memory of 2508	2328	msedge.exe	118
PID 2328 wrote to memory of 6020	2328	msedge.exe	119
PID 2328 wrote to memory of 6020	2328	msedge.exe	119
PID 2328 wrote to memory of 4420	2328	msedge.exe	123
PID 2328 wrote to memory of 4420	2328	msedge.exe	123
PID 2328 wrote to memory of 1612	2328	msedge.exe	124
PID 2328 wrote to memory of 1612	2328	msedge.exe	124

C:\Users\Admin\AppData\Local\Temp\pbirds_setup.exe
"C:\Users\Admin\AppData\Local\Temp\pbirds_setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Users\Admin\AppData\Local\Temp\is-N8EAM.tmp\pbirds_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-N8EAM.tmp\pbirds_setup.tmp" /SL5="$B0216,15739942,54272,C:\Users\Admin\AppData\Local\Temp\pbirds_setup.exe"
  2⤵
  - Drops file in Program Files directory
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.myplaycity.com/install.html?utm_source=pestering_birds&utm_medium=downloadable_install
    3⤵
    - Drops file in Windows directory
    - Enumerates system info in registry
    - Modifies data under HKEY_USERS
    - Modifies registry class
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2328
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2c8,0x300,0x7ff8bafac188,0x7ff8bafac194,0x7ff8bafac1a0
      4⤵
      PID:3924
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,15687532749307577775,11058308275254169690,262144 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
      4⤵
      PID:4836
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,8452229289034945424,5223515289128206702,524288 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:11
      4⤵
      System Time Discovery
      PID:4392
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,10180039830273685958,632801735802229477,524288 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:13
      4⤵
      PID:2088
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3644,i,14549669971315252870,6614343113844711668,2097152 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
      4⤵
      PID:1416
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,6915506955181146877,10136352107938501512,2097152 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
      4⤵
      PID:3260
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,11318602332291595452,2341726897421552784,2097152 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:9
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,6759714749884439131,9950960495200630475,2097152 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
      4⤵
      PID:3928
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,17282475126222863713,17659217794429544606,524288 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:14
      4⤵
      PID:708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,12639555306110808152,12207679828352959566,524288 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,16000958573236063074,1211030157319200197,524288 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
      4⤵
      PID:1068
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,3304495697022921169,3824255939295788249,524288 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:5512
  - - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,3304495697022921169,3824255939295788249,524288 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:14
      4⤵
      PID:1324
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,17396528521805507675,13531652105037038537,524288 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:14
      4⤵
      PID:3464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,16255262530264549445,3702835222639545949,524288 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:14
      4⤵
      PID:2292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6588,i,6403139326802155369,2851900795393301602,2097152 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
      4⤵
      PID:1536
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,15480296922762458448,8284816225997340059,524288 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:14
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,2605798392364052748,12337217711744942500,524288 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
      4⤵
      PID:2980
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,1559171394397908621,1669079741885675761,524288 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:14
      4⤵
      PID:2508
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,5449130065845571263,11201522365930390816,524288 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
      4⤵
      PID:6020
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,5565310641781729937,7171300855157563561,524288 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
      4⤵
      PID:4420
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,15065146602525862951,4346038179947060743,524288 --field-trial-handle=2308,i,13544626838540735092,4511798041195097036,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:14
      4⤵
      PID:1612
- - C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\Pestering Birds.exe
    "C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\Pestering Birds.exe" first
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\PreLoader.exe
      "C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\PreLoader.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies Internet Explorer settings
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:756
    - - C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\game.exe
        
        "C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\game.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3188

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1776

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MyPlayCity.ico

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\MyPlayCity.ico
Size 39KB
SHA256 d4e3c9baa32990d28bea65a2b20a3d30cb110c567a38046ec23e400e643c5f3c
MD5 95fb3c7bfcd474a42d987eafc07ece09
SHA1 b6dbe427b10aac48d469cce9c7912c8258b0211c
SHA512 bb1b2eeb4f9411355d8297c2ba44c40535102bc50ad4cb015ffb18dafce1631a565d6c4c633ef6aa2d48e5960d82b75d27063e0a20e4b844df80aa300a6e83b2
SSDEEP 768:lPwNHqUca+IwduH9uQ6+fh1HeRO7DHWlFdJRYGYFpL:lIM0/dH9D6+J1HkNYGYXL
TLSH
T1A303AE5A2946E5C8CA427379DC97CBF9031E6C4688E5120337BABD2F78BE5833C250B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Pestering Birds.exe

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\Pestering Birds.exe
Size 2.3MB
SHA256 00d5bd612e049543cb3b80d684e9ba5f0b04ff628e231deeaabe722ac732104a
MD5 3a1c5c0b0ed25a2b997cb0cf068cbb61
SHA1 d39db9533f54ade9a2a5dfd91bfe21e2e7e23e4c
SHA512 8840b3e27137494ff1b640c0cb9f0cdb454b0b3b38a56829e5d6311f7447c997219bf043bb709e8fca0b147bc2581a6535dda3d0aa5a65bba341c5725aa27527
SSDEEP 24576:LBdWjTEZs4p0smiOFo8GdcflzCWOIxIoXDBaSoo7Kl6RKZ2WHPESc7eFob9T3rBV:PWkFpCF7X3XDESpbRSNH8Sc7e8TH
TLSH
T1F5B56C32B244653FC0BB1B398927A6B4983FB7526D07EC675BF4094CCE355412E2E68B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PreLoader.exe

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\PreLoader.exe
Size 2.9MB
SHA256 5daa916bcb8b3742bec3dd7c98ed6601633842d168c83bda02c8b08b16e7ff1e
MD5 cc6792ce20f1e2cdcc782d391d21479e
SHA1 423b4cff71937e66fa249004b98cd8c5b9ca3ca5
SHA512 4613e49a9b57f20ceed39172d88e0fed1e0b976784c022b015a4b83a5e483bd291f234170ef13a69828d578d5ce5a350649b0c9eff99a76fe5d536336633cd38
SSDEEP 49152:fea8c0NUY89xyKLtISBfueqSt+/YFK/2/go:23nU79xy8qSt+QFEo
TLSH
T1F7E56D12B2C8643FD06B1B3A49779658983F77616E26CC0B6BF4094C8F359C16D3AB4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bass.dll

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\bass.dll
Size 95KB
SHA256 4e7b44ecfada6d59290b28ad5262a686e34ebf50ac859493c511bba18f38ad06
MD5 fedd2cea478da0d6d9d6799d4ec350af
SHA1 150a3e20173f84afad54652233f4fca9a545d9f5
SHA512 123ef3d85fec64962db8bcef96116f240fad919c8dddb802d3ed78d34aea60c4ca518b620c89da1e7b4d85dcbcd6524a7bcf3924488a53376130152ab940c898
SSDEEP 1536:iXrcASuvllnLoiUmEO246a+S/sA3peqj+fUfE+EnFrFQZP45o5TJhw95HD14X:4cAx9VoXmS46kheqgVBFQZw5eJhw9J5w
TLSH
T111930187F224685EF1EFD9318AF5218205E5BE4C0C87EFD58949C265C9BEBE00D91F58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

birds.ddm

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\birds.ddm
Size 628B
SHA256 111a0654d4151b8cc249a012e66420cd372cfdbc6a278e5f125f252b7d30610f
MD5 5d0a7e5d7c7780174abdd60295d50939
SHA1 59561393363e0c6c77b9e2de720b86b8da63459d
SHA512 02de49ea6513afe0609ecbaf42e40a400e8d3b2a078fea64774bbc173d388410c07c68db7281ec4312e66a9cd3ea7fcc6264fa0264f74dc120c01a0e7c9e7896
TLSH
T109F02B15C261C5B6F1BA5878593D7297EC67A371B162B911D45C308E048FA38CB28235
MD5 SHA1 SHA512 TLSH

Submit Download

comp_l.ddi

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\comp_l.ddi
Size 128B
SHA256 b8e15bcb338cf4ee80bf61031b87a76716cd0e513af6b9a15c4a1fa0c631cb56
MD5 770f3840ed94ae50412f18a98e68b770
SHA1 918061a8361cf4c6c707b4b1995c692fc0fa9334
SHA512 c939a94b48711f873492ad0fa73265c7197beb3ff1c8e83b0f29dab48d088bad9bd6ff199f8435e0b91b78d785e4d9ac711a96c2cc07d92e0bc66b01a1228f41
TLSH
T159B0220C322C2C0AF00008383B8F80308A80FCEAE0008B03BA02A80C00C080AFEA820B
MD5 SHA1 SHA512 TLSH

Submit Download

data.xml

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\data.xml
Size 5KB
SHA256 89374d62b6d97053714e6f9fad0beb25fa65888109fd8c3fb8b65f677bcfd6d7
MD5 29f184cd3bca83622738ff61a48d44df
SHA1 ffe26095c9aa9226b81bdd58629b23fb1d10fbdb
SHA512 9999d2cab15d4093ec91cab9fc86239b359937c68eb204b73b6cb593b49dfe66b96d244be2cf1f26f22f116cc62bf205280c7cc53e528b8428d90eb7714d7715
SSDEEP 96:ti5ctIX+DjcWAhJMGOYx/k2PT3cBnH+ar8/JmsPZGgPmDJ/M2uzlvT9jz2roeFxD:ti5ceujcWAhJmYJk+7unH+ar8/JmIZGb
TLSH
T16FC166353BEC276E81289237F9B46E242BA3EEFD771D11A59C10387E2F925381625F01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-3DGU4.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\buttons\is-3DGU4.tmp
Size 2KB
SHA256 52237594ee599c7b87e5162a352fa6db76d4f127284f6d128fb9c2b00cf57b8c
MD5 fcaa8d778d0dc4aaae5d955661016aed
SHA1 9528a7bd3c317e43ddbd8dbb833ed4e10192d803
SHA512 c761f69288e5eacd566690890ff6823262f8fa526498b6671d1e7c150b614a5b1ac801225077d2916a5804a4c0247d70271a00b84217391da783d2ab958901bd
TLSH
T1C3411A9F30B320AF16AC80E27E4102E43DDA963693BCFB8ED353834455F0620FA2E255
MD5 SHA1 SHA512 TLSH

Submit Download

0.cur

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\interface\cursors\0.cur
Size 766B
SHA256 5c85278c0c61be054c7daaad49fa665f857981041905ac868e30764137e997cf
MD5 b48fb99a06a4d33ba0a3078b2251d76a
SHA1 ffee4c5009260f88e87875a84b7bef33532a95df
SHA512 dba5889220330b74e563e13cc3e85323af5e906272d2da9384330c42167e43c7946a6b9efd4bf906d60cbb84ae884fd05076be6ad743a7e12bb94c5aa010ee92
TLSH
T15901E5917B3B48A0CC313530811B43C59EFE0FD65625E5B7199ABD8E3C74F1264212DC
MD5 SHA1 SHA512 TLSH

Submit Download

1.cur

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\interface\cursors\1.cur
Size 766B
SHA256 244234b5ef46ec88a6bab1532573f45d00cfdf3ba927170e465c9c490fd24a5e
MD5 4c0802164eba055fa27c9e0114910e83
SHA1 bbf3300d96dba5c8c313a498acddd80c1bb0ec0e
SHA512 cc16062b6f2f78c5f464d867650b002a121e3a6349f056117f424575efd3e58e77985687de6abc42ff88dda6e93d1e0409dcd4913c567bf2cd81eabaa9916b3f
TLSH
T130013950791B6E48F01079B0C15B87F6CC06CC9244B43282B09D3E9E3AF83307470BD4
MD5 SHA1 SHA512 TLSH

Submit Download

2.cur

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\interface\cursors\2.cur
Size 766B
SHA256 210623e2e6ebc718de6e2e21236aa7bd6024a75a9bf825a9bdc9f54b4b7d78a9
MD5 06e98541868f071ec7ebb8d1b545bddf
SHA1 80b5f2bae28857b3b6f01e3c1debceec6f5aa947
SHA512 3eca487741ef677d13c195e7198bec370d70f17a6a39c1a0b91989bb6683438f8391ae7c8574b7c266f8e6bc6fafed8171a735e17f5c3e28105384a7c8613440
TLSH
T1C1016D8234149670C3B42F7141AB3BF0ABC1DE237D00302200A17E9E683EBD0181C3D7
MD5 SHA1 SHA512 TLSH

Submit Download

3.cur

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\interface\cursors\3.cur
Size 766B
SHA256 3e8aafb614e9e1c2c0a0765f9a68001a176838954aec4abc2af74ce3b199fe8f
MD5 7f7840b492361e6323cfc33938e98da5
SHA1 4eed6a0498f3d0b833b15c810f96c9447b614415
SHA512 2eb8279e86c37cc93553a7f096934de8a71226ae54c090d7fcaac8349befb0eb258d53a0ca65411e6723b8e65f6b65f8b925b83b966cc5fea49ff67c1ba4c4d7
TLSH
T1B301650B322C88D0C00C0DB190BB43C08C0F8DB205296AB5055F7F9E2EB2AB0BD962AD
MD5 SHA1 SHA512 TLSH

Submit Download

4.cur

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\interface\cursors\4.cur
Size 766B
SHA256 dfc9794d423243777dfbf024e1cf9ea746c7320f69ed071495cb1c0a6e942a35
MD5 2f817a6048b793cc49364da6398551d1
SHA1 82c03e21e4188087b1d6a98d5b4cebfea6c0f2b5
SHA512 fb42486c3eccd778155d521d4efc1cdfb4ccdaa7cdb567129049a506b9a26d5864027c20f232b05f9da2e3de271b434348e84f32b5b6462619a929d5aa458444
TLSH
T15C01ED552525D599D4700A7656175BC584850EEB0C3CD2EEC8D6BDEE2CF0B20F4142D4
MD5 SHA1 SHA512 TLSH

Submit Download

5.cur

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\interface\cursors\5.cur
Size 766B
SHA256 0287a5c5c9a34b249f47768e415602174fa9e04b495f46ca7d7e65f34dcfb8f3
MD5 d67c561b7f6801c478864132799dba69
SHA1 0447564e49cc0690a76adf7833abaa531d61a99a
SHA512 579b39354700d9b2c415e9513afc3963abb3da73b5f2f24697cd9b17c9daf36e80a832770c166f9fc9610e475c5e5b0b3118f60866162eca2f604408108947d4
TLSH
T1AC01ED657F58ED41C0D82536952B83D08903CE5A7614DD63C9F33E8E7CB424099242E3
MD5 SHA1 SHA512 TLSH

Submit Download

6.cur

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\interface\cursors\6.cur
Size 766B
SHA256 28193dc465132fc96a005f632af662390771ec504437e12670cdbd73e92d9dfe
MD5 d578bdd6ce379315834e8f6ce7b1baae
SHA1 9ea1ccf1d6609397a6c3be5dcb6b79e50c5f6397
SHA512 b1006d7864d975f716f097db8d0e30a79822cfd18f8cfe47dcd290546af0307a0f5d1837807f4253f0d01113cecbd9e186ef1c29a811fde7775ae624c829dba3
TLSH
T1DF01EE96322EC4A4C9001530435B93C8A9068DBA3916B34AB6A2BFCEE87F204A8103E0
MD5 SHA1 SHA512 TLSH

Submit Download

7.cur

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\interface\cursors\7.cur
Size 766B
SHA256 1caab3631d81dd10721404252a6b30bc688b857a5e1a9c82ef58ee3b64b7b850
MD5 f8db94464b09908ec16866cb3874d8f3
SHA1 8517910bc663b4123575b16dd602685c1a446921
SHA512 d8fa4772318d1d71ffd37e8c8663bbe8765c923a455729b32e334a3502533bba1fc8790456bc3656fe5a9f35868e2fdb375b43c4b9342f3e8f6c187587f3c64a
TLSH
T1E00112827714875CC4502534C03B87408905CD327825B6863DA37DCF7F7724054213E0
MD5 SHA1 SHA512 TLSH

Submit Download

cur_bomb.cur

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\interface\cursors\cur_bomb.cur
Size 766B
SHA256 cb1ea4c988d0d6b930fb1b3b22450b07e7aaf34c6892395ccf2fabec7f87f61c
MD5 ed56f0a4e5310789a049ec932b5dc6c0
SHA1 a8cbb69b40604dbf22f9a32d5a31925e2127143e
SHA512 072586b6cbfdd5182686718b9c11a4e612bab4abcf9e80c1e64554d14a4002511bc2c0ebc59dc0457bbfb5e19d2660e90fedda434e0a44bcd14739381dfef794
TLSH
T130019235BD7C9D01E0213434D12B8394CD164CD2BF48518302A3BECE6B369C495312A4
MD5 SHA1 SHA512 TLSH

Submit Download

cur_ninja.cur

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\interface\cursors\cur_ninja.cur
Size 766B
SHA256 b179632dac37ed953f4a9cd94cf8c3c6a0ecaca4566834b88229d7c5f3da30d8
MD5 e807072202d58e37981ca5d69d52ab03
SHA1 06322f54256ccfd312a4649e5340c79ee4a096f4
SHA512 f41404c56b6d0df88189ab9101633148b301b917256ed415b7628b9b8efb103dfd5462ff5c252be2619c31d1b51b159070a298157c73a845853e3de6a6e0d2a8
TLSH
T1D101D8707128A048C4202177C02F5360480B8DD134556D85CEFBBCEF7D7D38165696E6
MD5 SHA1 SHA512 TLSH

Submit Download

cur_rainbow.cur

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\interface\cursors\cur_rainbow.cur
Size 766B
SHA256 5e4a83fdd84aa4d9d22c913f92d462ca0f9da8a4590275d353703d95db1a26d9
MD5 b69ce5f4678a6902335b030532554313
SHA1 1c96d21b44e767b15903811a1098242a99ef1587
SHA512 796fb251a5ea77118b50c5e26e934368709f2dd9f804f85d7b5cd34cf5286eaa9a195f5ee022c60f40e4c129737f100f30f6b2f27a0057eb00f0d616da424bc8
TLSH
T1A1019267B411C654C0410D729C6BE7A5880BDE086C14A15B35BA7FDE7D36E946559280
MD5 SHA1 SHA512 TLSH

Submit Download

cur_rock.cur

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\interface\cursors\cur_rock.cur
Size 766B
SHA256 04fb7d68cef8e13780607921f7468a306d7c98a835f8ebb160ac9af5f5a1c478
MD5 f4e782e11f2914589529b5befab8d7e8
SHA1 deeb5ebdc26f2d867314e6848c45951bd3222189
SHA512 2930fc0b84ab55a739e37e1a97e98c41127219f01cedb2c37a314d56e95e7ecaad0ab1e320a84db8c0247ebfb0d831b954ad229ca574a09c5b35b637df8802df
TLSH
T1CF011A36BE3C9511C4203438956F83D1C9674CE13B4864C301D7BDCE6A39AD5A6712A0
MD5 SHA1 SHA512 TLSH

Submit Download

cur_rock_b.cur

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\interface\cursors\cur_rock_b.cur
Size 766B
SHA256 812a72f08fcb1db6200e36ed4658efb67d519996fa3d2fa77e14456330f0c46f
MD5 b820c8f2554e52d9aef6d52a5419b1f2
SHA1 7658a2ed2ab40ce1f0a7e4176664b51f7b258b48
SHA512 54b8336de5ecd1bd6ba05bc3362eb02adf497b070348ab32b9e16c4f9c3566a589211b167f7e63671478b5d19c9e96775c3bae28c0ba0f2487c34d0d8d6341d4
TLSH
T181019A32FE7C9852C4203035913BA3D58D432DE17F4861C30192BDCE3E329D096343A4
MD5 SHA1 SHA512 TLSH

Submit Download

cur_tripple.cur

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\interface\cursors\cur_tripple.cur
Size 766B
SHA256 2ecdd63bf4cd9de0e3907726a8a75bfd850edaeaec3cd3bfaf90c4f13f5a1905
MD5 b83d1cd1c4fd2d1fa9c78e6b6f9dfaf7
SHA1 765b01462fc54b7d4d640153acb4ef9f5b4db422
SHA512 ec7b93bf8cd082fce7615f7586d6e5aef57be9143a6df8357567ccc4e8fdba0e36ff68bb3c342e7858f2acbebf585a1ae59a8c3c8e58862502dcd6ee45cfa71c
TLSH
T17F01E5A23816855CC42275B3D21F93B0CC16CDD1A968B55765667DCF1E702C4B154350
MD5 SHA1 SHA512 TLSH

Submit Download

layer0.jpg

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\layer0.jpg
Size 35KB
SHA256 39749cad0864b6b917e4c05f996d3578fa27f0994ec76ade0fff3316a85ae2ed
MD5 25b8fc5c12c0c61cf20b1fb46859f078
SHA1 e0a839b2cb7d1618c0d00e14d69febfe063880c2
SHA512 8b76cc85250793fc682a0efbc46e5af984756fa5a10f12580556319ccf3256736a90b9678da8abc98f2112112d8cc7972605abe72f284fb4c964b3133fd33ce7
SSDEEP 768:MZK53OpgUUUkmabwclgBq1mqf0xtw8AfDODf8waU3cbmYLR6I/Jb:wKliKmakcBmqgtw8Aq7VaU+Xb
TLSH
T121F2E1B69914EC6544F8BB5BE222F0B6A137DC7049E3036F6904410C36EAFC5A7476DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

layer1.gif

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\layer1.gif
Size 46KB
SHA256 5a1f586f1edfa3ef0e8c6908b0c0371781a623d8c156e206c850f3731b561c61
MD5 6696877c2bb6ec33659920e7bae514dc
SHA1 9a01e218976b21a672640911825b1636db78bb44
SHA512 f961b90ce6d10e4b6341de31135240ace3b30e48f1fb9949c924bb5c60f8b8abd97e628025d2361c8000d8d911b13ff0148598a6586df2b6211d8585251c9b03
SSDEEP 768:+TiejQfy6vriQ0N47RkoLFH8vKFakKH9HrOtYeHgziIe0Wk0pb:+TJQNW49ko98SQ9HrOtlAVrWkq
TLSH
T10223F2061911CFB14122A37D0F1BBBB5878807FBFAE9B88259D6313154FAE9D63507E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

layer1_.gif

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\layer1_.gif
Size 8KB
SHA256 5734273eb091a887b584d0550785b2999ac5172d5521ab32a0d7fc79ed143d42
MD5 db2afd2f7e23270ca9f6df4f664d71f0
SHA1 506dfdf7f93e9a8fb5d9d271bec1bb0b0c533050
SHA512 651dbbcf653cd86b2c33ec01c401fed3f8e128a9c89e86d7df8f9247c3ad2f2271e049bbe4c470abf4549fa7940bc1b3ba8c695c7c88717aa529716219b1f11b
SSDEEP 192:DnnnnnNMdzOAbcKlmnUgPvGr+f2/MCm3++z679jh796x:DnnnNuROUgPu8Cmu++79jha
TLSH
T15B02AFD285385212E5B55CF08BD4D47324CA1368D865CF0467FA2B5FA081F864BAB757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

layer2.gif

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\layer2.gif
Size 36KB
SHA256 4c5a25967ac541fca579fbec8e36bb18e4e9b2ec3411e177e7e8c7a47b5276e1
MD5 26e3776eb48e778b4971b5f87d2ba1b3
SHA1 9925521fd81ce2f2355d8e25b4633ad23af14465
SHA512 2c2fad163252de04182cbefe7acabfe84ffac414b86e2918c6d5837e39124753252711e3baa2f5c9a3832b7985fb30a6459f67b8402631bcce5d0e782db649d7
SSDEEP 768:umvm67r8tQSGRXmIPgM40w3yZXbM+gGyX7sF9e61VfakTANOzi3mV1oy2h64:05mR2I14OgGawjtfVANO71oyr4
TLSH
T117F202D7A4867E867335D5908636381932D52E5039A9062D5C9FDFCF8D23ABD408D32A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

layer2_.gif

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\layer2_.gif
Size 5KB
SHA256 afe7c787dc5ea1d6d079c50acfc691831b622492f6624d3fb6348da2bf32e5ee
MD5 91c1c2c82e835a06bbc1977c07117773
SHA1 5d522a63f83059ce5020624adbcdc780acd1db04
SHA512 1b1e73d2f50512744fd8847bf0a3d5e6b41ae93e76313d449c9474ab85908cd0a436f245b1990fe752079020c890723ba1564a6cc74a58098cb31535d60597d8
SSDEEP 96:4nvfnvfvH/vHKAg9tl+7efGW/7D0msqiW4IRTsq1Df0w2CjkfYmawYLPj0WBY/I:4nnnnn3gYyfGWTomsqi7Zq1DyaAkwM0a
TLSH
T19AB17EAF703A996608F779341EDA5D744FB130BCB8538B43A942197CA28911994AB72C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_stolb0.gif

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\stolb\_stolb0.gif
Size 2KB
SHA256 f569ad6c18ea1967e9569441c0898541c4d327968c4dbfd3bf7a288d76bb7420
MD5 43dd5ba3a214a474645462018c170f22
SHA1 6f84155bf4e82fd74d47e93a0fddb251f0e29135
SHA512 6b498bd88f61a89db21076aee713ea93bd40ae767e65a519e155d54129ae6f5c78618d7eed5cd7d54566a9bb53e855b29fbf3f4a9119100226ff217bfaa0dcf7
TLSH
T195514D40B174E3BA2AD121F851EA4FD148861035DE33BF5DB13874CAA38578458FC219
MD5 SHA1 SHA512 TLSH

Submit Download

_stolb1.gif

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\stolb\_stolb1.gif
Size 3KB
SHA256 26b93dae421736169ce031dda72d451ef1d99fdc0331e401f6e72b1319b608ee
MD5 7a7d58cc7af3d2ceff7dee2a99414561
SHA1 fc6b8e9c6a11a3d7ad61e91a45a2a9e3b6aefad1
SHA512 7cb95be96512c836b03e3b45b9649477cd337ba4ed5f99cab5668fcb33b22dd6e5812f56f554f82042e7b361fdde124de89989906a91dc99dec841038b765ca2
TLSH
T11D715AA3E2F8C8723DF0E07159C01E02CDAA6498ADC4890EF627BA54A163AD81A3E411
MD5 SHA1 SHA512 TLSH

Submit Download

_stolb2.gif

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\stolb\_stolb2.gif
Size 4KB
SHA256 7d969c4444447e2c3f3c354322c06e5a0625e94399cfc9786f09670dfe02e2e1
MD5 83df960940acb7de44dca1c3e046a106
SHA1 fa6a7bed22af1086d3622d7b12c1760c0de7f222
SHA512 ea9f2aa146fb838d587cfb1af29e0e966b895ce261ec8c7e2469be00ffc5c8934ff882134443433ff2f00b8d59c388e571e398e8c696ed467d4121f988aa9339
SSDEEP 96:5nvfnvfvH/vHb1eNxab4a9uXmDoBIhTd0q2ipNJjyk68sx/6+:5nnnnn2abHmmDkI/HBpNBSxS+
TLSH
T1E9A19E2932FA9C53ADDA311889F50968BCCE84C002F36E3EA469A1C0180EF4D807C92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stolb0.gif

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\stolb\stolb0.gif
Size 22KB
SHA256 541ce6bbaae78552efa9b17cae25834c37794af62352721d6969cb53052bca36
MD5 a34942dadc293b7a87f42bd98f880841
SHA1 bcc211306fc94db52549552591afaac284f62091
SHA512 8312ac83b962d879486065a52235739d8a0554c5b6e002f077882ef7ae2ab3d8e9339eeea51ed0c6fc43fc2ed8d65bf695f2ee2f427a4cfd279378723f9e23c9
SSDEEP 384:69UGOXbfDXiGbgnRv9eLUwD5sZomjAyO/l6/c6MNCTR0ouAshtFrP77KHj9sw/d9:69XOXDDXi/RvgHdsymjPO/l6NT6NJ7O5
TLSH
T1DCA2F1D478CF037B9BD0455D21AB7456F586B08E03A1ACA2C4172A1732117AEA8DAF4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stolb1.gif

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\stolb\stolb1.gif
Size 22KB
SHA256 f0b3a20d8e8c516e0796595579267a7283aa54607064a84ad0eba56befe520ab
MD5 b4f6ba93e0b08c16db64dc57f80b346b
SHA1 877f081fd50e41c0c05abd9bec585452a265116f
SHA512 d6f2df42ce14e3f89e05b4f797169fc014670d707dbe6f0eeabc69e00dd67b7175211daf6377d2c5c30999c03e20cddd89a181d5f318fc6e35222b5185bd1cd0
SSDEEP 384:5fyIfWcm1l09S0Pz7nw+eF4qiTTas3mW7l7weJ+jnxVnSaQ7xVkaj21Nii/n8+O9:xs1GS0Pz7nw+eWTmsn3cFVnskx1njM
TLSH
T15CA2D015B2104EAE2C7378900D08AAD9B18ECC6E49117120FF0F13D7C5A9C44BDADDDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stolb2.gif

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage0\stolb\stolb2.gif
Size 29KB
SHA256 368d41ae6ece0af17a3713f99f0d2af96f631ea57bda32ce15651826785bb201
MD5 d5c7a3496d30f8c01239db9cd2e58c9c
SHA1 b3d0d82dc75e8ab82a79113694a3f3000a16d1f6
SHA512 5aeba865cc8504e8ab61c5dc13dd7eb1142f9450057f44b7ee53bc1267d2a744701b00dc12dc88a46abb5a00b0443eb0e8a80e3de8f021ec0b81d6265d08f05f
SSDEEP 768:6B4GG+BVQhX9Mpaz2LwVZUTni985NLGm4UdTW8lw/M6:NiVQZ9Mpa68B25FGlUFW506
TLSH
T1E1D2F1C1B988C5DD3C991DCF64C5E092C0F67C700B89CCE9EE7C8B68688BD4A84E0847
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

is-D312D.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage1\el\is-D312D.tmp
Size 283B
SHA256 a876ed38f5b1e50858af719bc5d38b110e1a202cc063946899166cf073f0218e
MD5 94be55a139be906da83a573f3a694019
SHA1 6ed99fba03542a445d1bdc98cb4cd97e4b2f4630
SHA512 5f802852538f2f195d9788038e7d3bfa668671bd4fc21ab98a14b193292b989ac6053cde819f6dd4c3f2619ba0f3bd687dab5a4f2f6c712ac927ad05d2e350cd
TLSH
T196D023146880D175C8C160305C0C87205C574C4E44E9450C3F5C351135E6570739ADC1
MD5 SHA1 SHA512 TLSH

Submit Download

is-4P5IP.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-4P5IP.tmp
Size 311B
SHA256 67ed94e8ddd2e684415505a137e80d13f6b5369ba693716518c6743f294b3f7e
MD5 ac628cd3b7579063a96f5a00c3fd06b3
SHA1 501740ec12f22be0a8f61b1e404959586fd0c427
SHA512 b930386733edf870ff0a2e094f114aa0c771004935b55207d98c4b194aff00779c6e24c91aacb4a381bcd37031c70e1776bb3beae8af6cdea70b46f294d22301
TLSH
T16BE07D6EF9708998E0054479C021877C69604105464C6307A1D45BBF7BAD0E5A26D595
MD5 SHA1 SHA512 TLSH

Submit Download

is-5J359.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-5J359.tmp
Size 529B
SHA256 3a9dad72702b1ec19905532596668670975a3b177f418260f327c4849585bc2f
MD5 db77074018ca9b8f8c76e55d46f6b8bc
SHA1 db8009e9670adc2e90d73c6e5caa564c8afc2536
SHA512 7654ddfb17048726e4e33b4b663410f6c486e5976c7d570a895b8a760a20224a7472aabde1b3f54a8d3cc1f732a674e5fe3d2748e48eb4313b652a2c7de13304
TLSH
T16FF0AB53FCE0C250EA705D36187E6349A0DA801E9E5923223E64A1ADB242223C320258
MD5 SHA1 SHA512 TLSH

Submit Download

is-5MVLK.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-5MVLK.tmp
Size 529B
SHA256 2688c33f9b9882eb53e721367d52e9a48b40a5f300e79961fa8137abb005f6af
MD5 8ae0ff78c2848c97f9603ca70c2990a5
SHA1 fbb1713386dbebe66256fc29c044a1b999822265
SHA512 5a1cfbaa1019625d62c33491327bf82c3920f71ced5a5cec14626272d650a4591a0cd1817e991a111ba947e4da8d047b10d829331065069fa1f0385eec76c4f1
TLSH
T148F0F1F6F40CD340CED502FB128781E517E9E3D64A0908047E0CF30DB85063080BB606
MD5 SHA1 SHA512 TLSH

Submit Download

is-618VO.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-618VO.tmp
Size 866B
SHA256 8c3a26330b1f0529c8617d81f8098e65c5215b5429d14c8e5611d90372d31e6e
MD5 cf76547e25591097012adb5f1e85298e
SHA1 94989147d047b02a88afaae346a4df8e9e33cb41
SHA512 5043c7cd87b0c6dc473d2738fb6cb490bc5d2ba66ea6fa2a9ea5f8d47158b6d594c9999a96c03fa5975a68c19e6d238a50bc33849e816d19ec159a407e321cce
TLSH
T17D1152E5B1BAE1232DF8163849C0CE62CC80242438624F8EF76B68A47345F956D2D13A
MD5 SHA1 SHA512 TLSH

Submit Download

is-6DKCG.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-6DKCG.tmp
Size 881B
SHA256 ba3cc1c1e82f2f7e6c2d5a45cbf8550a77e9f87a29f6cd043ff320d032b372bb
MD5 0e89f9f31af006fd9868f76c690d64ee
SHA1 fa85978a0a7d3507e2c7f2701c96fa7392338882
SHA512 12f0e5a199302c57b17b81efbe644ecdfbc0f31052875e6411d6250ff45a1584526e843d7943754ae6fd82d5c088597fccfc9fac2e24ba220658a8a3771943e5
TLSH
T1371192E4F2FCD2132CF4453949808E71CCC8252434724F8DB32B2D94A289FAA6C2D13A
MD5 SHA1 SHA512 TLSH

Submit Download

is-A4B7K.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-A4B7K.tmp
Size 866B
SHA256 1e7eafb7cc2a318dce09d4ad9debff7d7c74a984ddd527ae2c11e365f3047336
MD5 097502c8c6b647372ea21689104c84b4
SHA1 77e3af64dc95da92a3ed6702304a4c7ff4103071
SHA512 251c6701437a6c6aa53be4cf24a9fb162de5fa9948d7a38c60e50eb2c4f8a91a3f06ed726cc0fca0a74e4479a6cc4d1c717fa45639ab50614c8361114db37d78
TLSH
T1221152E0B2A9D1232DF559395DC0CEB2CC80251838724F8EF66B28986249F661C2C23A
MD5 SHA1 SHA512 TLSH

Submit Download

is-BNV94.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-BNV94.tmp
Size 122B
SHA256 b399711d08b3195aa0114ded71c4c4bbe876ae2634b9bc9bbf7278902493e2e0
MD5 340062b3b28c77c5762eafd098ff7217
SHA1 7098fe463728b1240a9b5ea2301cdcbb8d863bdf
SHA512 4a88f25fbe4b318414af908f950756f8b8c870b1e440c5896f5ab2a4fe071108596e8bb4d03c384368092be3641581d0f12a16fc71e7e19b9818bbe98692b198
TLSH
T14CB012B4A370F43CC34784341F4859D1039CA2CBC40B43087BD81F09FC500355121832
MD5 SHA1 SHA512 TLSH

Submit Download

is-DBPSG.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-DBPSG.tmp
Size 535B
SHA256 154928a9283ed80e0c931d7ae3dc0a3bbca3ff0bc90caf77f50742b86bc77a54
MD5 af356d6cf509ed235d6af36305b1b6e4
SHA1 e70689e4c05318f5049b29c78f26e90fd4e2744b
SHA512 e348098b59596c0122370f3f2d358fa70635ba1592425f8364a32655d124bf2ad2776fae53afc2e244d7de0f52353a11941a16256db73419df68be19eacb7a4c
TLSH
T119F0AB5AD3A19904C908203A1485880A09B46E628CC953D96E6AB60FF6B45B28130760
MD5 SHA1 SHA512 TLSH

Submit Download

is-E6BM2.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-E6BM2.tmp
Size 540B
SHA256 4c983fc11f07942a07656acec779ab144990f466dc2ef3ddc7a8de1e49d51670
MD5 bfb10bf99a0ad8728427caae048f462b
SHA1 3a2accd8bbb85e62e36c332e634029c693216552
SHA512 c0d219f3699578a2533c6eaf89e846761193ed8a2ef1a3a8a903974fe5ee68544614263782ef51553407673ba676bc144de2f52f31a466e0ed9e264d107998a3
TLSH
T184F0237C15D153A1D495C836495103850C8B183D9B9320CD7C9EEA08B7189721718240
MD5 SHA1 SHA512 TLSH

Submit Download

is-GGN0C.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-GGN0C.tmp
Size 872B
SHA256 fba6a6539b902dbe4b0b6d8083f7f635f7f1e5a9c82ecf084084ce44d4d193b0
MD5 cac90a430f88b1a6869f80cb496076a8
SHA1 8dbc2b398634e2be16a51cc7483168a93d9de005
SHA512 2d179d5b24ee7804cfd6961890174995d1081a96e4c2a466de788a7127827764dfa9a88a44af317dc7f901532057895b2cf25baf0174c27d512aca00d9194699
TLSH
T1F7116FA0F1B8D2232DF4493849C0CEA18C84162838721F4DB3AB2C846249B992D2C13A
MD5 SHA1 SHA512 TLSH

Submit Download

is-IV1F0.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-IV1F0.tmp
Size 836B
SHA256 12e980c39ab822c691ea9e671db3fd75886f285f3de43805096d1e192783f76b
MD5 f0b747ffd36386cf9ff30c735831d859
SHA1 f9fd3fd151707a5668cc57470bb7d256a8d59791
SHA512 b4f77307cc038b41b1f347c37055d43bece5e0987998013c24ba7c50825bd5afdcba8abda9dd17bbebffd91981f4436d4baa3b817363b2da61ae19cdf438e1ad
TLSH
T1AA0112A4B1B9E1122DF555345DD08E61CC80151438620F4DF6A728946249F555D6D13A
MD5 SHA1 SHA512 TLSH

Submit Download

is-LPOQP.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-LPOQP.tmp
Size 883B
SHA256 7089029f084b0268cfed42b2071b1852c87903e89bfd0cfe3e3fa5a826326f1f
MD5 1b647b2fcc49063f68deb2bab09648fa
SHA1 26bed6e498b99cee4ae1bafefb59b96e1f1d33ce
SHA512 c9b329910d9064a50f8ce6bd14940702a0b97c6b7399ec286c28d2ab826cdf12542b2bceafbf5f19dad09a2389b940e37d2c1a62ddac84a73625f398e99006ec
TLSH
T1E31163D0B17DC1133DF4653949C0DE228C80155824620F8DF66729907245B951D2D13E
MD5 SHA1 SHA512 TLSH

Submit Download

is-OKCK1.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-OKCK1.tmp
Size 874B
SHA256 c2a7b921b0ed2395dcd8db775ecdf7374169e6acc604b84ab348783250c08743
MD5 43a8d920a046d0a79d92459863da6ee3
SHA1 c3101d841b02aff933cf0ec7c149d4c8f956e8b0
SHA512 d73b089554517c2c81439d12e8c67034c513356170d5102a9a71ceb2c5b7845b9086ceb344da328304c77b6852908a8a876bff940bff9a379a5ecd6ca2c92613
TLSH
T13A1192A0B2BED1132DF405394AC0EFA28C84101535734F8DF6372894A24AFA52D2C13A
MD5 SHA1 SHA512 TLSH

Submit Download

is-QHEKF.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-QHEKF.tmp
Size 311B
SHA256 308f7cc97dbb9a6e5e5ffed00b1cd505c034807b5d4a00c4fa40d2193d59aa15
MD5 3d7282a2c686ce636629e37e13ef557b
SHA1 ff9135dfd64eee17cae9639fd5bfbc8a87a3b9fa
SHA512 b01cca4d67a124bb51d786939ce445ef11b9ed33e6c60bd064142accc20257b5673a0e074d8c6ca7d75bbb5f1c97af14bff0439b1e5e9430813d0c022b583641
TLSH
T192E02D3BAC60A1084014AAFCCE24120069B2C6063A1CDE8747C07228A25800893070D3
MD5 SHA1 SHA512 TLSH

Submit Download

is-SH4DR.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-SH4DR.tmp
Size 541B
SHA256 b32cdeaf9a0ea928423bb466b3e88c745f33e583a2887ed9f2efc09b864f1edb
MD5 875d8e4cc0ad4a6191f346e1a0600414
SHA1 c55b824850de5bd063f0e365c31d3e6e903f91ff
SHA512 ca41c54faf91a3b89af166269cf894a2d5bb076271f21040ccde71dd8091d15a85afb4fe58198e05870e977912271000ae11cc61940e49c614c97c26b759f66e
TLSH
T1A8F02398F4F09A30D374F13D8CAEA1201038904681D1005532EC3C8C333D4EC222D9D0
MD5 SHA1 SHA512 TLSH

Submit Download

is-V64TD.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\el\is-V64TD.tmp
Size 311B
SHA256 7a3b877142fe30b2e17516ea0409a0a548092f51c9636f2e8a91b8206021cf5f
MD5 cf2690cea45a125c75bb36c1ab5c1842
SHA1 083074a2cdc1ce2b5db60bba630096deb141b971
SHA512 642832f9875f3f11d4a43f36b3b1d9279efb563815f302394dcf7bd674b25fb22f0d8e70fcc649c31554078c70028f3c4995348da415f5bfedbe9023d1622aa5
TLSH
T1E8E0CD9EEAF7D112BD3C85366860665593B4CD06356DD6470041290AD928552A118BDD
MD5 SHA1 SHA512 TLSH

Submit Download

is-QB7P5.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage2\is-QB7P5.tmp
Size 42B
SHA256 37b019e810ea7fcb14287dc783de6618fc54be23e632a77cec2002599acdff14
MD5 0eeae5bfe1f01643d54e800df9299727
SHA1 6502a3394a5595b75f44f463d9b1453443fdcec9
SHA512 9487029eeb57066f4c536df03d1ea85a9ae1e0a122a6b4b109150cc5b53783f48e51d77b62ff84ccee4cf57cd8b34cabfd1e1d08dba96410070282ca982cef43
MD5 SHA1 SHA512

Submit Download

is-UGRM7.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage3\el\is-UGRM7.tmp
Size 836B
SHA256 fa0552c3fc2d2f33d3fdb752bfa8e4f55dd6ff4a77a453755f7d13389a7608ec
MD5 a0638a321fdcb562454e2f9654febcc1
SHA1 21d2d82c5c5a584588c77a1d3a14bd1ede139405
SHA512 b77b5ecf72d0ebfa8bfd966f875e4d10afe86d7e41fed0e66c600531f6f69512b24f9b19130e7a29e27d4068b07e676c026f32a956e4e47de53576f11ab69ee6
TLSH
T1C90152D0B2A9D1122DF555784A808E618C84245438630F4DF37728A86245F651C2C13A
MD5 SHA1 SHA512 TLSH

Submit Download

is-TI5O6.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage4\el\is-TI5O6.tmp
Size 954B
SHA256 46113db4311c73a48c9cfa4672cef4e1501875fc1f8240884a70577d2756cbd3
MD5 624aeca17cc0d0598e67d3ecfc51e1cf
SHA1 833279a084f9c586a7aedf33956ff35661c8823b
SHA512 5b1c4b6935d5972e8c27c44ac6789acc463e8ce605ca25034f0f3cb681ab7ade54277d8387ef5152f91c6cc5f67623ebd8eeda79d2284325d6058a534e6f62ad
TLSH
T1F211FBD1B2F8C0233EF112389AC0CD25CC50215468530F8DF7273990110AF821E7D13B
MD5 SHA1 SHA512 TLSH

Submit Download

is-SHI8K.tmp

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\layer\stage4\is-SHI8K.tmp
Size 381B
SHA256 e743b64dfddfd4c158c670585ff90a4b57c045decd8397062f12f00e1d39f073
MD5 b097c317041415b54f19115474457d09
SHA1 26f90149a6ec951e394b8b11384102246e408342
SHA512 40a649c4d0fb7bc4acdd72dcb74573999505473c44d175574eca76e72ab6a9a1465ddbaa8ea1748548bd8abca7b1d2ddc1aeff9adb18ce2004c3d52ce8c9f4e6
TLSH
T10AE06A737000C35717D24EB244548F6AB9C00F7049DB1945D907DA1F25C041F2D4ED17
MD5 SHA1 SHA512 TLSH

Submit Download

_logo_company.gif

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\menu\_logo_company.gif
Size 7KB
SHA256 042bdb5a58df6d82c8a2ebc3a20130ae217839d6193f58f9e9a0923115605599
MD5 00c7a5d946e197c8c7f927591e9ef577
SHA1 e9ad1af22e2ae48376d356ea136c580b92e9c61b
SHA512 1bebdcdbb5d350d76ef1f07da24f2f98f5c9edb2becfcdef8dc09204c9c0549817d83c2b759c9c89082b54299284b10b813b09d75ec7cae2aecaf557b1934819
SSDEEP 192:GyYuOYqFrKSeG36fkA8bv0GguKiNHaOqFyzcPUCVIRNGYUit2:xXqFeSb6fbwguKiNvIyyIRGo2
TLSH
T157F19F1BD0A6BB15779E1B5C11947C8A1EB2FDAE016985FA7C4CE70A932F003D9A53A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

logo_company.jpg

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\images\menu\logo_company.jpg
Size 25KB
SHA256 2bf66fc6b8ee912d6079174319e44055a754d1b70911844f341e493c671ed9de
MD5 81e552a5b9bb350c3b8ef2086b98e814
SHA1 5ef3091d757bdcfc46f2f3e562918fb0ca3f9eec
SHA512 5f0c178c806717332e0f26ae7f6231e0ea140e857aeb68c79afce830d7c74be4dc24c05a79e383afe011673ac81bab575b65517ba3e8754ec8d65025b82d2a73
SSDEEP 384:LmmwAoL4qs8yi5nPpolKO/GPaugi2HPwlyGy7xPJnzY37/g1PLdHF19:LwAy4qtPp8KZPkPw0Gy1PpPF99
TLSH
T13FC2BF4601847E3FDFEF141722B9C97AF4059478B533E695ACDC26B3F98B84A2C0A748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

texts.ddt

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\data\texts.ddt
Size 33KB
SHA256 ab5b05fc87d86eca25c07901b87e113494e9b4f1be83aa8a347be0eb61269384
MD5 cf42b03e023d1b5bae93cae7858ea602
SHA1 ceaa0d26c058a242ae552e3f86141a023bcf3ae1
SHA512 383b7764513ae5bb5123a0751b2bfb4b43347a2bc76eb77bed76ef2c982aa1d7918eb57216b7fd23c8a3e4d8f3fda90b322653a8c3401449a956386ddc767991
SSDEEP 192:VfoWXNQty1PAXoPZWUmXYGOX3lLKDwC1KA0l1K1HZWWb5KhU2G:Vf7dky1PVPAFvM0DHehU2
TLSH
T18CF2C8EB76F0DDADE176A837102C71A218607EF5DCA24621D8F4319E05607745DA82FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

game.exe

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\game.exe
Size 1.8MB
SHA256 4a34cf3f05686280e79595f4e4a2eb955811cb788f222b682da1530c050caf3d
MD5 b9ce34db6e4d4d9820ba45752893db49
SHA1 6e3c95c4b8eac64f21057534cac74622ecf7a78a
SHA512 a63f7d1f5217b201c6fdd89048ba9ca0dc06b0929aa9e182ca9192f85e0a40ada0c356930099935e102f66aa61e5182be327448d16be98d0027919e1e4f4fa0b
SSDEEP 49152:kIM2HlZ2hd/7PuYrxTVLes0PYEEDnKgqMBW2bwF46U8FMvdMeMF:k6H7ed/7P3BVLesky8VMvdMeMF
TLSH
T1EE85BF22E686D177F8E706F1CAAE5B4A40292F71171405D7A7D42D9FA8746E2EB33303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

toolbar.ini

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\lnchdata\toolbar.ini
Size 604B
SHA256 fd963978563cd90c89f85aca4d53b18ab2799b4716bb13450033e86517497b00
MD5 8b4d6ede1ef03a68d9cc6b0161f4fbca
SHA1 d188ea0d0c7ce411ab68265e91a4e924fc0dbb2e
SHA512 4281526768d4cff769a2d41bbb7153979148093c391ecf9fbbb4fbcdde1041089198d348543a734930c35170692bb118640aea709057955659f0e3158dda894b
TLSH
T1B4F028EC48AD2DC94A368EA260FCC305DAAA60B51B568ED7D8510CE51595D2F2631304
MD5 SHA1 SHA512 TLSH

Submit Download

pgame.ini

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\pgame.ini
Size 188B
SHA256 7645a0f697e27b46602f8b38dc1f15cc200289c66a8e7bf34c00451cd604c7a0
MD5 a396c78e6c878e815de5b7dfe46bef55
SHA1 ffbff8183815c9fb1a14f992cc88a3f49e2e9bf9
SHA512 34f06a3042aff4c55a00d95dd032bb4a42bd34444f38d7054d970891072d697bacaa1dbb2068c64b113ecd9a01783fdef57cf5625cc86fcb09f70e853e33d4ce
TLSH
T185C0128B4AC6CC264677C1914BE87160D299A1D1D2504D714AC12690283196574D275C
MD5 SHA1 SHA512 TLSH

Submit Download

profile.dat

Path C:\Program Files (x86)\MyPlayCity.com\Pestering Birds\profile.dat
Size 16B
SHA256 374708fff7719dd5979ec875d56cd2286f6d3cf7ec317a3b25632aab28ec37bb
MD5 4ae71336e44bf9bf79d2752e234818a5
SHA1 e129f27c5103bc5cc44bcdf0a15e160d445066ff
SHA512 0b6cbac838dfe7f47ea1bd0df00ec282fdf45510c92161072ccfb84035390c4da743d9c3b954eaa1b0f86fc9861b23cc6c8667ab232c11c686432ebb5c8c3f27
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a26ab33e941c20685c25a9885f0b5459dae60875ad2d216ea789162b0c34d85e
MD5 fde7e96472dfc3b89603c6abf571085e
SHA1 37d7b035de989384edaf598e90a57a8940044cd9
SHA512 4c93aa4d51c5c974cb40e15a59241a31a144addfa1b3198874c6b3edf553dc625f24368a4179860dd1e3315245b0bea37da57c16de4b44d62cfbd9dfcae79a8b
TLSH
T17271C84433EA2AE6DB18447511E1185836F087A5DD53FF96E04BEE78E4A2F38D2D8227
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6582.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a6582.TMP
Size 3KB
SHA256 17b2068cf272ef49effc21843828617e1b733ea8ab1217e9d4575fe9a6286a5f
MD5 e8c877125bd133c73627a22d1b3a0387
SHA1 f15d7dfca65a081dbdde12ae778099adc2062916
SHA512 24502b03d6e46df2cf37b959882492b1c87eedccfc41b030b92bdb3dac70c08167bbc950d933ecdecd5b7b2ac882c3b4c96ea19ca9381260ecc294bbb35093ee
TLSH
T16361A45423AB0AE3D32845B161F1145836F086F5CD47FFAAA04E8EB8D4A6F34D0D8617
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 39a244ff0a768fa097feb9a733e53d548e6457918aef99f39daa7c96292b4cbb
MD5 dfbc5bf315b690e268b6dd4aa3976552
SHA1 b098d0663828129fed835c439f14d61494a68734
SHA512 6d82c9f339f48d4cbf6c263b97abc240043534460698802fb5d02997f7bd9998f68f48c8b845832f5129ef4abf99ee7e36f6d804b411d346b5f57ddb2e61d3f0
SSDEEP 192:DYppgaeLJqVaayv1EVPV/6/WghbPYtWRTvIMvH5TKuSzZhkT:DYppgae9qVaayv1EVPV/6/WghbPYtWRR
TLSH
T1CFE1AAFB93E4866EC90151F4AB552E2BCE2D0624936C382F88D4DF6797E34E2E14164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4a5fcca86ae26b9a113c78a37dbffbe4f6ba9e62c265abbf43be5ae36d44b841
MD5 11de1a1ae50bd820d478f0956da2d108
SHA1 71b94491d2ee1232ad5f8002a7a58b3b8c731c5b
SHA512 6cddcd7fec670165f5a76f333b29b1f064464eb9d67d3a283b37b09874b43828d5028375c52b0a08cfb40237565735b2e3e8f7aa6dcef9b1d607eb20a9ce4e41
SSDEEP 192:sxRYRyCV/f2s+LZEjLgzoA8pce/g6+WNVxH/JQ/Cr5ND/WrIjVI76FoZyICYmGiA:sxRYvV/f2s+loNb/5X/qjQVVF4B
TLSH
T12852D856A9286D7B4CC7D219F615FB63E6F91132E1901E84B7FCCA1C00EBADD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4c17b170f79b7f36d30c29e9ae213aed3bcf108ab4e149df522d8f120de6ef7d
MD5 54b441b92f082ef5466109837801c14c
SHA1 843604f68afe562a4a35a61ccfd4fd36abd85475
SHA512 a0c8347235eee16e633f40d933bd768d68f2ac15d527b53068c91956b592b25204e33eea90811caf4dd51c09101c3182c16b86a037b37dae05295a20102029e5
SSDEEP 192:sxRjRyCV/f2s9LZEjLgzoA8pce/g6+WNVxH/JQ/Cr5ND/WrIjVI76Fo2yeCYmGij:sxRjvV/f2s9loNb/5X/qjQVOF4A
TLSH
T11D52C7566928697B4CC7D219FA15FB63D6F91132A5D05E84B7FCCA1C00EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e9297ae885724ce731fd7778206be1357b2760e8360d0b77e1286d632f863f4e
MD5 9dc9086ffdbcae0f08d3a6597007ca5a
SHA1 4dea6e2061ae47a990a12ee304f5efed21b84afd
SHA512 ccccbeeacce6dfba545165a689f50baae7ac67c060f2a9787bf51ca8c028bbd1f2d4615dc74c369427c7b1f875440a723e5db9046661f5075ccbc552c88c1f22
SSDEEP 192:sxRYRyCV/f2sCLZEjLgzoA8pce/g6+WNVxH/JQ/Cr5ND/WrIjVI76Fo2yeCYmGiu:sxRYvV/f2sCloNb/5X/qjQVOF4D
TLSH
T1FD52C756A9286D7B4CC7D219FA55FB63E6F91132E1D05E84A7FC8A1C00EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 29KB
SHA256 568d313d88a9852daa65e0b2b2d666d0a49c6cd1fcfd482906a50b632520b547
MD5 28dbf14dfcd853efd5eba1abf8d69af5
SHA1 8a22fce7851b0eccc730345016ebfdae770b06b3
SHA512 abfe08ab774e55004d4e2d2a1e90b6df2879469c074d2fe39496dc5b12a5577f8a7c5a15e957b59c7add95559700415a5a5e31caa091afffaf1ee269d52f37c7
SSDEEP 768:j26Huo7pLuL7MRWgs2f028F1+UoAYDCx9Tuqh0VfUC9xbog/OV+6BVuwbro9ze0C:j26HuUE7MRWgs2f02u1jaB6B4woqp
TLSH
T1A6D2DB7B640DCABF4F800ADDEC197E9E6D6802CB9698CD8047FE951C02C6BEE51164DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5ae33d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5ae33d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 fda1b0da610023767613836ef9752c25fde688fcf88e42f5aa56e6b9a41d64eb
MD5 dabc47fdbe529714ab3a7e75724ba530
SHA1 e5ce622456d12701dc9b0a01b50a487c51fa5a9b
SHA512 89c626e5fb2e0573bc62fa6741bcc1db47dbec41a55be98117e9f657715df54dd9f7f14116ae51ccd9c89d7e881560598de7ff29baca7d0075871b5131b0cabd
SSDEEP 768:dFn03zwgLnopsOWoSc4ONXyer1IRCzni9OMgoc3:r03toF4SIqnVMgoc3
TLSH
T11D1329F194D38A37D8AE5383A73D6E429EBCD063B4884590BBD55E4DCC865BFD30A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 073bd1394b2a739dbe1cf7346ea12a5e17526554a30b97d23bf918fa88d93769
MD5 55b3248945466efa55748e0a68887725
SHA1 8a3102619beeac352e08afd6ab580bd510d479d1
SHA512 e97058c8640bcdb8fd62c35266d6855f2882e68ee9747aadb47424e4d6f5482d4bad2687da7d4d96d389bb8fc9074c8e3e416aa0a469174c495570290623d7a9
SSDEEP 768:Frv+4UNbdz3jF/TBOWoScoONXyer1IRCzniwOeVH1SK7:FbsbV3J4oSIqnyEH1l
TLSH
T1DE03B031A169DE334DE6A395B147A7837FF82067D9800B90DCDA1F4E0A9B59E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 cdd4cbd900234ada8ffe90329c959112e42cc0b108c1ea9747465fa20b1e580d
MD5 be9a724a33772d45fb395536041a8118
SHA1 b622da6065b9e7514f348a3fdedc1903fa396d9b
SHA512 58c78943063c47d40582abac442c5fdbecaceb1867530028b029e9f747cca5b8042703d766bcc9541847e2e925beed523feac615addf2b241a2c9ede09da65f8
SSDEEP 768:Mf3393/TBOWoScPONXyer1IRCzni9OMgoc3:Mf33d4PSIqnVMgoc3
TLSH
T172F2BF31A5A59E734CE6A3C2F1076383AFF42067D4C44A94D9EA5F4E0987A5E170B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 7603fce9229b19086ea92738adf0ca4b458d1b9894b4a7f9f222915dc42575b2
MD5 d9269ffa102161489ff15874e2c77406
SHA1 96cef8cb7dcd9e29dfe9c0291ff40720241a0fdb
SHA512 0514aff2b1594639c65256ab518f93f397ec05e9aba6ee2e2a2aba95550593f43e7101498fe53fd6637ad372c4da0d61973b9dedfa891d583f9eda0abba885a7
SSDEEP 768:6/3w/3/TBOWoScWONXyer1IRCzni9OMgoc3:6/3wv4WSIqnVMgoc3
TLSH
T170F2BF31A5A59E334CE6A3C2F14763C3AFF42067D4C40A94D9EA6F4E058BA5E170F81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0b7a5fa736deee4dd47d33e60d46dc5d1501ebee61d3fe0753a606dfa4fdbb5a
MD5 6d26e08d0c3e99aeb346a4329fb10f8b
SHA1 d80e5cba884adb8bceaf60f80288790a951cbacb
SHA512 3edee1e18c31b19defa1df7201b3b8584a93889483ebe13f8c951e5e39e2030ab0393973f39d052138151fd803e7256073853332067309e32b7ca1aeb8ce8ec9
SSDEEP 768:lrv+4UNbdo3Q+3/TBOWoScaONXyer1IRCzni9O7:lbsbW3Qy4aSIqnV7
TLSH
T1F303AE31E5699E334CE6A381F10767837FB8206798C50A94DDEA2F8E059B59E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e514229ed2e728cecb904ffb3267e1dd2769bb1f71d16f7ef98048bb36157b9a
MD5 aa8d3f02b35d9f962bd83eaefc56a20f
SHA1 eb947e7f9d216fa1853fa40ee13766fc03ff9020
SHA512 def93972808d804c00d993b8fd2b63e523506168bed890d1ec9364fea3163d7926eed7071fd5f6a91f4332e27d1e332929c731207a262bdf27007375c833771e
SSDEEP 768:hrv+4UNbdz3JI/TBOWoGONXyer1IRCzniBzeVH1SK7:hbsbV3qlSIqnMEH1l
TLSH
T10603BF32A4A89E338DE2A3C6B14776437FF86057D6800790EDDE2F4E069B59D230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 132B
SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
MD5 f5a3b29f9a977e23d6ca4eb728238f9f
SHA1 d2c5576fff1189eb66493b5b677d79a8ecead68d
SHA512 6f692909efad02642f6c3a4b7cd10b21760c6fbfd3bae39d3b8a77b22460fcd5f6b0ab6e262b007e533c406a981968b3e0894697ca50be7f10bf557f1c1972f3
TLSH
T128C02BD0883D5142CD620D5AC04301F420005C1C641C0A7804C814C0401142F328042E
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 252B
SHA256 aa807e4f1b970e487ba89b4ed9f5455dfb3acaffb192b8736b7bd0ccf63b8cf5
MD5 880fe67d2d8def8a73d1f09d09f8f2ff
SHA1 adad7fdd0652919461f89bfe36b449081489052b
SHA512 dec205f202a88afbf96f8015158638483f643ad02a9549b9eaef405a32a1ef2b2cf9c9480d70ccb43ef9ce64818827c6fe3cd27267f657cc33cb6ace9619d87a
TLSH
T18CD02B80043D0A82CFA50A5EE41749F810C44918759C197804CDA4D5501A067315881D
MD5 SHA1 SHA512 TLSH

Submit Download

2695326e-a8eb-49b5-b868-c95de159b448.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2695326e-a8eb-49b5-b868-c95de159b448.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

innocallback.dll

Path C:\Users\Admin\AppData\Local\Temp\is-04VL0.tmp\innocallback.dll
Size 63KB
SHA256 6afa2d104be6efe3d9a2ab96dbb75db31565dad64dd0b791e402ecc25529809f
MD5 1c55ae5ef9980e3b1028447da6105c75
SHA1 f85218e10e6aa23b2f5a3ed512895b437e41b45c
SHA512 1ec4d52f49747b29cfd83e1a75fc6ae4101add68ada0b9add5770c10be6dffb004bb47d0854d50871ed8d77acf67d4e0445e97f0548a95c182e83b94ddf2eb6b
SSDEEP 1536:+VqUE7JhgAzj/ZuhnOwKWSAXvze/V2C0mswp91:gWgAnB3XDAqt/p91
TLSH
T198534A17B5E14AB1E0A2CABC5C399314873FBD302E78D599A7BD0DCE8D393829858357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pbirds_setup.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-N8EAM.tmp\pbirds_setup.tmp
Size 680KB
SHA256 427fa988a8a8c63393693ffeb61ddec195f000220ee55fd5112ec91682e933b0
MD5 ed69e64731547eba52476a2d2a2f7882
SHA1 cbcd56bbb5230d11a01f18e9bf59f97802bb475b
SHA512 04202de8dafb4c8964230d94eb44ad8ffd1d138b24f445aa3d707f4d9a9e9520d3d6f80cb0731ab9ebb7143011fe0d856d7e262d9672272876958d5e8ad55afe
SSDEEP 12288:L0QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGv35ELAfXExy8:ffKbT5lrPo37AzHTA63/cfU9IEU353f0
TLSH
T103E47C32F2A0D837D1731E789D1782955936FE103E39A5A776E81F0C4F792817A2B2D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2328_462581993\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Legends of Honor Online.lnk

Path C:\Users\Admin\Desktop\Legends of Honor Online.lnk
Size 1KB
SHA256 bb30f61242159816f6acf4aa7c7efb58b16623bfcc11cd504da2e37a664f0b44
MD5 c76f7bd8617391a6d0030e8b9abdb2a7
SHA1 c2b2066c52dc1056eea5295c597f8edaa602a8b6
SHA512 de81ddb373b63a54a65bb902e595556062ca8a1ee3b0abbd2f06e3943faeed0b2ec24658cfd80a0555dee158f51dc48325442dcf7b1da8397a22c712642a0937
TLSH
T14921E92023FA194DF1F31FB998B641925A37FC206E31C50D512500A818F0E15EA36FB7
MD5 SHA1 SHA512 TLSH

Submit Download

MyPlayCity Games.lnk

Path C:\Users\Admin\Desktop\MyPlayCity Games.lnk
Size 1KB
SHA256 55cbf66ec87d0878c6d0298f58f194f74eba0693f2ba2dfe930a012ce1d6946c
MD5 44d230cde3a83b6b3c3a053286ba36c6
SHA1 543bc4c04542b0f688ba334ea87114dc3dc8fb06
SHA512 2873298cc92a0ba86a2f4e879e7657acd2a04685e73b8e1a0e939191e5e5a81830122baba9bdbb79fbed8f39642d9aa245401fc1c0f52fd149239c58e2bf77a5
TLSH
T12821905057ED0A09F2F30AB8997252C1593BF432DE64C6DD0661408D58E0E28EA76F67
MD5 SHA1 SHA512 TLSH

Submit Download

Pestering Birds.lnk

Path C:\Users\Admin\Desktop\Pestering Birds.lnk
Size 2KB
SHA256 2b4d2936d5b689381ff46c5eb5f3760570af50ea3512f2952647978515b22b6d
MD5 af9b03e5090bca05c7c9651b79fb0a74
SHA1 def1cc3cdd857baebc9abf4e1ca6ed8723bfd106
SHA512 c3c401c1047b8e73450c91e35c302ef9bdab61364fbb680a1468dcc5c0559e11f36d57abf2ad6f3333da1591120ad8496270e82e93597bd50178ad7af59f7b80
TLSH
T1424190014BE7095EF2F3CDB15CF102675A13F815DFA98A2E4295018819E2601FA6EF5A
MD5 SHA1 SHA512 TLSH

Submit Download

Play Online Games.lnk

Path C:\Users\Admin\Desktop\Play Online Games.lnk
Size 1KB
SHA256 2a61597cf4b61bfd2286c36d9306425c501e8cdb2adc993f34ea3317a4a42274
MD5 b086eb9ddb8c1141a269a44cd654fcfe
SHA1 bfdf46b280c4ebe98f6760ef602c1a977cdf1e45
SHA512 d25eda103704cef3472c97163d0ce77a89fe9a4a3af354789ae3859cbcb762b8f135387e84afac12c83a7504ddf7f1a3e770d1ab2a4b79864618b61210fbce94
TLSH
T1BE21F69066ED2A1AF3F35F786D7641D24C3BFC138E22C58D1262518914E1A24EA31F73
MD5 SHA1 SHA512 TLSH

Submit Download

memory/756-3193-0x0000000000400000-0x00000000006F3000-memory.dmp

Download

memory/756-3205-0x0000000000400000-0x00000000006F3000-memory.dmp

Download

memory/1680-3265-0x0000000010000000-0x000000001005A000-memory.dmp

Download

memory/1680-3224-0x0000000010000000-0x000000001005A000-memory.dmp

Download

memory/1768-3031-0x0000000000400000-0x0000000000663000-memory.dmp

Download

memory/4208-2099-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/4208-27-0x00000000024E0000-0x00000000024F5000-memory.dmp

Download

memory/4208-32-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/4208-14-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/4208-19-0x00000000024E0000-0x00000000024F5000-memory.dmp

Download

memory/4208-23-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/4208-3026-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/4208-8-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/4208-29-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/4208-25-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/5536-24-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5536-0-0x000000000040D000-0x000000000040E000-memory.dmp

Download

memory/5536-3027-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5536-1-0x0000000000400000-0x0000000000414000-memory.dmp

Download