Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://builds.tomat...

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    357s
  • max time network
    443s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    03/05/2026, 01:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://builds.tomatocake.dev/Robotopia-v01930-Win64.exe
  • Sample260503-bddbsady8k
Score
8/10
adwaredefense_evasiondiscoverypersistencespyware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Windows directory 2 IoCs
  • Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

    When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

    defense_evasion
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 60 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://builds.tomatocake.dev/Robotopia-v01930-Win64.exe
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3144
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x280,0x7ffb2ccec188,0x7ffb2ccec194,0x7ffb2ccec1a0
      2⤵
        PID:3912
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,4182030720266586508,9699388229768527635,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:11
        2⤵
        • Downloads MZ/PE file
        • System Time Discovery
        PID:2988
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,15643668673024086242,3826516035074397811,262144 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
        2⤵
          PID:2848
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,10720189857533053677,17774674933777475718,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:13
          2⤵
            PID:724
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,15565592357913957360,169664228160934696,2097152 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
            2⤵
              PID:3388
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,8295981491469412254,5592817300529278392,2097152 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
              2⤵
                PID:4984
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,6355842837780607531,12847559832942738758,2097152 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
                2⤵
                  PID:2248
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4144,i,4125025137101424899,5789622385478046928,2097152 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
                  2⤵
                    PID:4660
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4176,i,14779322504954935312,12272635241343863638,2097152 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:9
                    2⤵
                      PID:4312
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4164,i,5371924716363247767,14146924910299430778,2097152 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
                      2⤵
                        PID:1836
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,16897810759957192551,12185671391353963891,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
                        2⤵
                          PID:688
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,3144467238339253915,14240139743461024516,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:14
                          2⤵
                            PID:3152
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,8450874203905252703,12466513054124129899,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
                            2⤵
                              PID:976
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,15322371045597887907,7019083768685800261,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
                              2⤵
                                PID:2072
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5924,i,16168049280607765857,13504169986257923243,2097152 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
                                2⤵
                                  PID:4928
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,16318067201699941745,5543562203760621664,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
                                  2⤵
                                    PID:5068
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6928,i,12329828971775937914,13581511389663879913,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
                                    2⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3388
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                      cookie_exporter.exe --cookie-json=1128
                                      3⤵
                                        PID:4680
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,15666330903227373945,5864126157044616474,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
                                      2⤵
                                        PID:2248
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,15666330903227373945,5864126157044616474,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
                                        2⤵
                                          PID:5036
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,12855193048978975844,9671102988153278175,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:14
                                          2⤵
                                            PID:2244
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,9807529151993411668,15545138324900673439,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
                                            2⤵
                                              PID:1596
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,9076809644900818873,14860061549450720185,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
                                              2⤵
                                                PID:4784
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,6361389974283578016,3566973866562900297,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:14
                                                2⤵
                                                  PID:1280
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,5776315326931561005,1682529483077253335,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
                                                  2⤵
                                                    PID:3568
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,8382293315911658477,16791703163221108258,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:14
                                                    2⤵
                                                      PID:4912
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,15993870490809414751,13004213429983785228,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
                                                      2⤵
                                                        PID:2340
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,2631739496218588720,4530007490236512832,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:14
                                                        2⤵
                                                          PID:5088
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5356,i,8017319894909663649,12625192549859950979,2097152 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:1
                                                          2⤵
                                                            PID:4632
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,316106887468492630,11780193419829960576,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:14
                                                            2⤵
                                                              PID:3452
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5520,i,3388529929794441856,17147843299287511538,2097152 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:1
                                                              2⤵
                                                                PID:892
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=6120,i,16452499845203087607,9866526282629291346,2097152 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:1
                                                                2⤵
                                                                  PID:1792
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5468,i,13650737792854686248,9978004745773481589,262144 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:10
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:4472
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3992,i,14190185690339141465,5386478708770156134,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:14
                                                                  2⤵
                                                                    PID:1368
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3996,i,3351094998423999391,8964918268712956404,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:14
                                                                    2⤵
                                                                      PID:2772
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,1783380358354839172,237858813804494228,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:14
                                                                      2⤵
                                                                        PID:3092
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,18354962392231863146,15346949166496213966,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
                                                                        2⤵
                                                                          PID:1200
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,3725856053911650945,1652752020092157772,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:14
                                                                          2⤵
                                                                          • Subvert Trust Controls: Mark-of-the-Web Bypass
                                                                          • NTFS ADS
                                                                          PID:2308
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=5452,i,5445175169982404365,5913306425760462558,2097152 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
                                                                          2⤵
                                                                            PID:1636
                                                                          • C:\Users\Admin\Downloads\Robotopia-v01930-Win64.exe
                                                                            "C:\Users\Admin\Downloads\Robotopia-v01930-Win64.exe"
                                                                            2⤵
                                                                            • Executes dropped EXE
                                                                            • System Location Discovery: System Language Discovery
                                                                            PID:3360
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,6081028403501266983,1153396993387070666,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
                                                                            2⤵
                                                                              PID:2792
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,15626356580773478886,3815876738081098792,524288 --field-trial-handle=2228,i,1637053101480069084,7896145531208475107,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
                                                                              2⤵
                                                                                PID:1156
                                                                              • C:\Users\Admin\Downloads\Robotopia-v01930-Win64.exe
                                                                                "C:\Users\Admin\Downloads\Robotopia-v01930-Win64.exe"
                                                                                2⤵
                                                                                • Executes dropped EXE
                                                                                • System Location Discovery: System Language Discovery
                                                                                PID:740
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                              1⤵
                                                                                PID:2640
                                                                              • C:\Windows\system32\sihost.exe
                                                                                sihost.exe
                                                                                1⤵
                                                                                  PID:5088
                                                                                  • C:\Windows\explorer.exe
                                                                                    explorer.exe /LOADSAVEDWINDOWS
                                                                                    2⤵
                                                                                    • Boot or Logon Autostart Execution: Active Setup
                                                                                    • Enumerates connected drives
                                                                                    • Checks SCSI registry key(s)
                                                                                    • Modifies Internet Explorer settings
                                                                                    • Modifies registry class
                                                                                    • Suspicious behavior: AddClipboardFormatListener
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    • Suspicious behavior: GetForegroundWindowSpam
                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                    • Suspicious use of SendNotifyMessage
                                                                                    • Suspicious use of SetWindowsHookEx
                                                                                    PID:4764
                                                                                    • C:\Users\Admin\Downloads\Robotopia\Robotopia.exe
                                                                                      "C:\Users\Admin\Downloads\Robotopia\Robotopia.exe"
                                                                                      3⤵
                                                                                        PID:5848
                                                                                        • C:\Users\Admin\Downloads\Robotopia\UnityCrashHandler64.exe
                                                                                          "C:\Users\Admin\Downloads\Robotopia\UnityCrashHandler64.exe" --attach 5848 2309974986752
                                                                                          4⤵
                                                                                            PID:5844
                                                                                          • C:\Users\Admin\Downloads\Robotopia\crashpad_handler.exe
                                                                                            C:\Users\Admin\Downloads\Robotopia\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\LocalLow\Tomato Cake\robotopia\SentryNative" "--metrics-dir=C:\Users\Admin\AppData\LocalLow\Tomato Cake\robotopia\SentryNative" --url=https://o262863.ingest.us.sentry.io:443/api/4507146082385920/minidump/?sentry_client=sentry.native.unity/0.7.15&sentry_key=c7d13207076c09421b097d681cfa2aa9 "--attachment=C:\Users\Admin\AppData\LocalLow\Tomato Cake\robotopia\SentryNative\07ed849c-9406-43e0-b708-a4db0af0701a.run\__sentry-event" "--attachment=C:\Users\Admin\AppData\LocalLow\Tomato Cake\robotopia\SentryNative\07ed849c-9406-43e0-b708-a4db0af0701a.run\__sentry-breadcrumb1" "--attachment=C:\Users\Admin\AppData\LocalLow\Tomato Cake\robotopia\SentryNative\07ed849c-9406-43e0-b708-a4db0af0701a.run\__sentry-breadcrumb2" --initial-client-data=0x6f4,0x6f8,0x6fc,0x6f0,0x700,0x7ffb1be85b28,0x7ffb1be85b40,0x7ffb1be85b58
                                                                                            4⤵
                                                                                              PID:3736
                                                                                            • C:\Users\Admin\Downloads\Robotopia\crashpad_handler.exe
                                                                                              C:\Users\Admin\Downloads\Robotopia\crashpad_handler.exe --no-rate-limit "--database=C:\Users\Admin\AppData\LocalLow\Tomato Cake\robotopia\SentryNative" "--metrics-dir=C:\Users\Admin\AppData\LocalLow\Tomato Cake\robotopia\SentryNative" --url=https://o262863.ingest.us.sentry.io:443/api/4507146082385920/minidump/?sentry_client=sentry.native.unity/0.7.15&sentry_key=c7d13207076c09421b097d681cfa2aa9 "--attachment=C:\Users\Admin\AppData\LocalLow\Tomato Cake\robotopia\SentryNative\07ed849c-9406-43e0-b708-a4db0af0701a.run\__sentry-event" "--attachment=C:\Users\Admin\AppData\LocalLow\Tomato Cake\robotopia\SentryNative\07ed849c-9406-43e0-b708-a4db0af0701a.run\__sentry-breadcrumb1" "--attachment=C:\Users\Admin\AppData\LocalLow\Tomato Cake\robotopia\SentryNative\07ed849c-9406-43e0-b708-a4db0af0701a.run\__sentry-breadcrumb2" --initial-client-data=0xdb0,0xdb4,0xdb8,0xdac,0xdbc,0x7ffb1be85b28,0x7ffb1be85b40,0x7ffb1be85b58
                                                                                              4⤵
                                                                                                PID:3924
                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://discord.com/oauth2/authorize?client_id=1248347935218073622&response_type=code&redirect_uri=http%3A%2F%2F127.0.0.1%3A46821%2Fdiscordcode%2F&scope=identify+guilds.members.read+email
                                                                                                4⤵
                                                                                                  PID:5448
                                                                                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                                            1⤵
                                                                                            • Enumerates system info in registry
                                                                                            • Modifies registry class
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:1884
                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                            1⤵
                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                            PID:1136
                                                                                          • C:\Windows\System32\rundll32.exe
                                                                                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                                                                                            1⤵
                                                                                              PID:5816
                                                                                            • C:\Windows\system32\AUDIODG.EXE
                                                                                              C:\Windows\system32\AUDIODG.EXE 0x00000000000004B8 0x00000000000004C0
                                                                                              1⤵
                                                                                                PID:3156

                                                                                              Network

                                                                                                    MITRE ATT&CK Enterprise v16

                                                                                                    Replay Monitor

                                                                                                    Loading Replay Monitor...

                                                                                                    Downloads

                                                                                                    __sentry-event
                                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Tomato Cake\robotopia\SentryNative\07ed849c-9406-43e0-b708-a4db0af0701a.run\__sentry-event
                                                                                                    • Size 1KB
                                                                                                    • SHA256 c5d16eaca160e29fdab38732d044ecd5a68fc3bd25d8bcff2c3ad28bce3acf92
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    1777770468_6784__891857880.envelope
                                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Tomato Cake\robotopia\Sentry\6A24F4BD907987471AB7BA0C26D999AF6593D82D\1777770468_6784__891857880.envelope
                                                                                                    • Size 371B
                                                                                                    • SHA256 3c0358833118150a57704e02215194426ea3b9cc201b601a8f81b1789fee5b9e
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    1777770474_-1074_028f5b90e1e1432fa5558a8c16b234fa_1165808456.envelope
                                                                                                    • Path C:\Users\Admin\AppData\LocalLow\Tomato Cake\robotopia\Sentry\6A24F4BD907987471AB7BA0C26D999AF6593D82D\__processing\1777770474_-1074_028f5b90e1e1432fa5558a8c16b234fa_1165808456.envelope
                                                                                                    • Size 11KB
                                                                                                    • SHA256 601e4fc594d1b696d168e80680c84105e50f08f188b47fad4ad1c7d0804b44dc
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    blocklist
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                                    • Size 105KB
                                                                                                    • SHA256 9dfa6aedebac0b2a7a6a4b7cf7a5385b714d5fbe36a5f334877adc4e59f7bed3
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    settings.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                    • Size 280B
                                                                                                    • SHA256 eacd218daf22fcefbc23ae70ce919d8ac95b89c3f7d038f647296c47a218fc46
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    settings.dat
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                    • Size 280B
                                                                                                    • SHA256 7173f2853e3b591f142ed047bb6a2ea62d5d817f9016fdd31efbebd88f820e91
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    7abd01d9-1b04-472d-b8bd-88dbed676958.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7abd01d9-1b04-472d-b8bd-88dbed676958.tmp
                                                                                                    • Size 31KB
                                                                                                    • SHA256 40247815628bc916030c86fa789f5be96c3294f7089889303f04fae8f3ff5d1b
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    BookmarkMergedSurfaceOrdering
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                    • Size 6B
                                                                                                    • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    the-real-index
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                    • Size 3KB
                                                                                                    • SHA256 9beacdc91d8dd45d002d3cbb051e6ca32fd39c5d17d3e898b76bc1d4218d3bf0
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    the-real-index~RFe58946b.TMP
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58946b.TMP
                                                                                                    • Size 3KB
                                                                                                    • SHA256 e3ca6eefc9310b9810e01bf5e93a5367513eee68cc4e2310fc1a335df929c414
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    SiteList-Enterprise.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                    • Size 2B
                                                                                                    • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Edge Profile.ico
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                                    • Size 70KB
                                                                                                    • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    HubApps
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                    • Size 106KB
                                                                                                    • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Network Persistent State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                    • Size 1KB
                                                                                                    • SHA256 589544f90aee8921914b08ed7823443b108b1e33668224bc6154d665d0efb44c
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    Network Persistent State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                    • Size 2KB
                                                                                                    • SHA256 b6b5979b4d8e4e03bc029be8eab9c1ab9f5571684bacac3f3a26d58428152701
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    Network Persistent State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                    • Size 111B
                                                                                                    • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    SCT Auditing Pending Reports
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                    • Size 2B
                                                                                                    • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 12KB
                                                                                                    • SHA256 f05eb2685c230f1afb5aede885cfdd6d0203612880ebdea726e0512dfcc124d5
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 14KB
                                                                                                    • SHA256 930f3675b35392f11c13385c731d20331d30b6dd106a4a17cacb4f165128e4ec
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 13KB
                                                                                                    • SHA256 ef287fe9420d35d3cf251bd3a50ae2130cf443dda1d2cc525eef8a0f81557030
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Preferences
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                    • Size 13KB
                                                                                                    • SHA256 e82c6434eaf2b69494110ebb8acd243669d7ebc78dc584a1344621ffcbebba6f
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    the-real-index
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48166f30-78f6-4da5-98a5-a0ff368b9888\index-dir\the-real-index
                                                                                                    • Size 2KB
                                                                                                    • SHA256 9615d48455f75b8055d70adbec87c78d1c0467d81838ea416501f2c2f8e98664
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    the-real-index~RFe5cf8b0.TMP
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\48166f30-78f6-4da5-98a5-a0ff368b9888\index-dir\the-real-index~RFe5cf8b0.TMP
                                                                                                    • Size 2KB
                                                                                                    • SHA256 d79e0e78733d52ab7a2e4fdcb58e9c5733cf9e10d73d42faab6da4dab942fa39
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    index.txt
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                                    • Size 371B
                                                                                                    • SHA256 8ef2c2b5b2123d598f1e624bd310eebcb53ddcce3665ccfb260291a36e9f1afb
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    sync_diagnostic.log
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                    • Size 9KB
                                                                                                    • SHA256 cc54ff25259c350134cd39d993eeb1b182d44702c081d94fbe789007a0a7c2af
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    CURRENT
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
                                                                                                    • Size 16B
                                                                                                    • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    MANIFEST-000001
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
                                                                                                    • Size 41B
                                                                                                    • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 21KB
                                                                                                    • SHA256 fcbff1cfb45c5ea89aaad3a89f0d35948874a3ef9b4b402f885c87b8618060a8
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 21KB
                                                                                                    • SHA256 33d69fecc0fa9fdec61bb9c0e96c5b12fc975ff58aa07a7b72a5792578dc6f86
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 21KB
                                                                                                    • SHA256 a90a91708d971bcba3be4eaca22a7e23837a7e24d00b80dc96dca253f60983c0
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 18KB
                                                                                                    • SHA256 5dcc53f716b334db38a3ce0d5ae0a25666340952adff5e30107cc5670b989b32
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 18KB
                                                                                                    • SHA256 ded87e483240c82efd4ff93ac1c7a0de825085ba2467f322e33fa6832d0e4f99
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 21KB
                                                                                                    • SHA256 b7b835e98605ae1e759197e6ef4f30b1dbd8b2d4adf871359fb1d52f3734f579
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 8KB
                                                                                                    • SHA256 fe6654eec1a1848c062507653349b86f0c56c04cee102f8e5db36ba5360d5f54
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 21KB
                                                                                                    • SHA256 0a2ed3cf9f0bf9bc5658ba28803600bef8c1e380d179ff378f042dc3d4fcde1d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 18KB
                                                                                                    • SHA256 358d50dfc282e4952fc95b1e8538a6e9bb4d7cfe516420faaf0590cc0cb50b86
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 21KB
                                                                                                    • SHA256 c9a94966d091f80c84c0b7827102562c3fee0298a27dfb318b04bb4763df241d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 12KB
                                                                                                    • SHA256 965d69ff2e7867bab944d54caaa0d5ec58b3371ac206cd73d687be2aecc0e9e7
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 21KB
                                                                                                    • SHA256 8c22715df77ffcf795ac5cb3b904e1dc3c18e9fb1d8c51ee168d27880236a36a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Local State
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                    • Size 8KB
                                                                                                    • SHA256 d37d01b136ac5c00b3ae4a8893daeb8144f4effa93bb773348bbbc77908a28ab
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    metadata.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                    • Size 132B
                                                                                                    • SHA256 f4aa1676b1cc0e8c932821d57f7e6ec93246f48d7b840aca2d58ef9fac0ecd03
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    metadata.json
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                    • Size 252B
                                                                                                    • SHA256 9ea5bbd4491542e3878ce1dc40d90744197996ad91a29e27be679d4bec62570d
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    e9423d7e-bfe8-4b9b-b4ae-eaaa271a89dd.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e9423d7e-bfe8-4b9b-b4ae-eaaa271a89dd.tmp
                                                                                                    • Size 13B
                                                                                                    • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    iconcache_idx.db
                                                                                                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db
                                                                                                    • Size 28KB
                                                                                                    • SHA256 b8e86245a2d6f17dec5859e27c53b5658638c5c2aaa5c364cd39ee0bc75c2eb6
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    3b9b6d6e-4df2-4f2d-9609-f4f0e3f1d984.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3b9b6d6e-4df2-4f2d-9609-f4f0e3f1d984.tmp
                                                                                                    • Size 10KB
                                                                                                    • SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    3e7a33b9-8c71-4150-bd65-90037d482147.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\3e7a33b9-8c71-4150-bd65-90037d482147.tmp
                                                                                                    • Size 1B
                                                                                                    • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    9e4db507-d87e-44ee-86fb-2074e9911294.tmp
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3144_2117630729\9e4db507-d87e-44ee-86fb-2074e9911294.tmp
                                                                                                    • Size 147KB
                                                                                                    • SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    content_new.js
                                                                                                    • Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3144_580065305\CRX_INSTALL\content_new.js
                                                                                                    • Size 10KB
                                                                                                    • SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Robotopia-v01930-Win64.exe:Zone.Identifier
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia-v01930-Win64.exe:Zone.Identifier
                                                                                                    • Size 92B
                                                                                                    • SHA256 585ddd044e79373cfbe5b52584be0e4154fa884f4bb3e4b5430563b7ae393794
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    machine.config
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\MonoBleedingEdge\etc\mono\2.0\machine.config
                                                                                                    • Size 28KB
                                                                                                    • SHA256 e91782a27fa39fc6c1d6ee8b08529f5d35052310d0006034b878eb04b8f2af30
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    settings.map
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\MonoBleedingEdge\etc\mono\2.0\settings.map
                                                                                                    • Size 2KB
                                                                                                    • SHA256 49c6160f9d54af4270a3b4e997fc4a8301f79b9e2070118fa46ddbcbbc44f9a2
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    web.config
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\MonoBleedingEdge\etc\mono\2.0\web.config
                                                                                                    • Size 11KB
                                                                                                    • SHA256 cf2b54339e069b9e42f7d6795eecbf562c50c1011f4ca8f65f578fe52d97ff92
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    machine.config
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\MonoBleedingEdge\etc\mono\4.0\machine.config
                                                                                                    • Size 32KB
                                                                                                    • SHA256 e60aec2c5115d65b3acb3c55ea21576dbd770f579166c017125571e46ae560ed
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    settings.map
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\MonoBleedingEdge\etc\mono\4.0\settings.map
                                                                                                    • Size 2KB
                                                                                                    • SHA256 ce1db1ad8a9512073164e3eccdc193f7eda036e1a9733caec4635de21b2865c8
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    web.config
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\MonoBleedingEdge\etc\mono\4.0\web.config
                                                                                                    • Size 18KB
                                                                                                    • SHA256 e38bb8cc68fe5b4edecdfd288d094b9e8ced7629039b2a347682aba0d8bd7492
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Compat.browser
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\MonoBleedingEdge\etc\mono\4.5\Browsers\Compat.browser
                                                                                                    • Size 1KB
                                                                                                    • SHA256 8a1082057ac5681dcd4e9c227ed7fb8eb42ac1618963b5de3b65739dd77e2741
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    DefaultWsdlHelpGenerator.aspx
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\MonoBleedingEdge\etc\mono\4.5\DefaultWsdlHelpGenerator.aspx
                                                                                                    • Size 59KB
                                                                                                    • SHA256 751861040b69ea63a3827507b7c8da9c7f549dc181c1c8af4b7ca78cc97d710a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    machine.config
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\MonoBleedingEdge\etc\mono\4.5\machine.config
                                                                                                    • Size 33KB
                                                                                                    • SHA256 ee950004b576fb28dc85f4b0435ed04bf96612de2e8b53be84d07afe85a0de6c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    web.config
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\MonoBleedingEdge\etc\mono\4.5\web.config
                                                                                                    • Size 18KB
                                                                                                    • SHA256 c4cbddd4fd9347b58cc5a72b36dc4ba1ad2bb699e65869d05cd3fb9865f0d824
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    browscap.ini
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\MonoBleedingEdge\etc\mono\browscap.ini
                                                                                                    • Size 304KB
                                                                                                    • SHA256 4ddd50f31fb968f30bedefc253a46dc3f2890192d05cdaa9e0a64a056eee807e
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    config
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\MonoBleedingEdge\etc\mono\config
                                                                                                    • Size 3KB
                                                                                                    • SHA256 5776169973a26a387b8b3e5c0f2301a7ab9a6dd7c7d3efa22a96abc47fbf8662
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    config.xml
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\MonoBleedingEdge\etc\mono\mconfig\config.xml
                                                                                                    • Size 25KB
                                                                                                    • SHA256 0c56e34c69124510fa8c19e7b4c2ca6c1c4ff460ae19f798dd0ca035809e396d
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    Robotopia-v01930-Win64-debugdata.7z
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\Robotopia-v01930-Win64-debugdata.7z
                                                                                                    • Size 8KB
                                                                                                    • SHA256 4be2163384479d7b9f577b489b79b8298ba58935ee849cbc26dbb04e97ee42c8
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    app.info
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\Robotopia_Data\app.info
                                                                                                    • Size 21B
                                                                                                    • SHA256 56ab6ceef722b33ccdc08765711bc2d721020ff1c68176231ffd2723da5afd0e
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    boot.config
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\Robotopia_Data\boot.config
                                                                                                    • Size 156B
                                                                                                    • SHA256 065a66c7c2a1ee63ff137a44af0a163548f357a4a402ec59e64db738c8c128f1
                                                                                                    • MD5 SHA1 SHA512 TLSH
                                                                                                    Submit Download

                                                                                                    globalgamemanagers
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\Robotopia_Data\globalgamemanagers
                                                                                                    • Size 271KB
                                                                                                    • SHA256 3be67cabdfcbcad9322878ef72ff4fbc61154a5b33d9ce816cbfb20d34eac9a5
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    globalgamemanagers.assets.resS
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\Robotopia_Data\globalgamemanagers.assets.resS
                                                                                                    • Size 7.8MB
                                                                                                    • SHA256 85e4b03e50bd7e24797043dbcb447b315491234a7249914b39a356322aa02473
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    level0
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\Robotopia_Data\level0
                                                                                                    • Size 4.5MB
                                                                                                    • SHA256 ecc4ffcbb6a55176e4b5c09ed16d6c29f6f53af3a791c63e83f89b99ccd8767c
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    level0.resS
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\Robotopia_Data\level0.resS
                                                                                                    • Size 6.3MB
                                                                                                    • SHA256 82b52f5473306a0a2312e1d33e2ad783143143c0516701b66f48c5ca216e18ed
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    level1
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\Robotopia_Data\level1
                                                                                                    • Size 16KB
                                                                                                    • SHA256 e71c9a812612c6b7783f4c0ec4e8952fcec390f1afd55f4ebaa9ecdafecfe89a
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    lib_burst_generated.txt
                                                                                                    • Path C:\Users\Admin\Downloads\Robotopia\robotopia_BurstDebugInformation_DoNotShip\Data\Plugins\x86_64\lib_burst_generated.txt
                                                                                                    • Size 276KB
                                                                                                    • SHA256 6d2eff99a16dacb41ff02af092194d6de081b38e1072ac29431052f6f2094290
                                                                                                    • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                    Submit Download

                                                                                                    manifest.json
                                                                                                    • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3144_1239596449\manifest.json
                                                                                                    • Size 43B
                                                                                                    • SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
                                                                                                    • MD5 SHA1 SHA512
                                                                                                    Submit Download

                                                                                                    memory/1884-1571-0x000001A260530000-0x000001A260550000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1884-1548-0x000001A14D9A0000-0x000001A14D9C0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1884-1547-0x000001A25FB20000-0x000001A25FB40000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1884-1486-0x000001A12BC80000-0x000001A12BD80000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1884-1570-0x000001A2609E0000-0x000001A260AE0000-memory.dmp
                                                                                                    Download

                                                                                                    memory/1884-1586-0x000001A25FA00000-0x000001A25FB00000-memory.dmp
                                                                                                    Download

                                                                                                    memory/5844-2065-0x0000023C692B0000-0x0000023C692B8000-memory.dmp
                                                                                                    Download