hxxps://www[.]mediafire[.]com/file/6sh44we11bj84ar/GTA+San+Andreas[.]exe/file

Resubmissions

04/07/2026, 04:39

260704-e9zrfafs9n

04/07/2026, 04:34

260704-e66etafs9j8

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/07/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/6sh44we11bj84ar/GTA+San+Andreas.exe/file
Sample260704-e66etafs9j

Score

8^/10

discovery installer

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
418	4460	msedge.exe

Executes dropped EXE 6 IoCs

pid	Process
4244	GTA San Andreas.exe
1428	GTA San Andreas.tmp
5872	GTA San Andreas.exe
5320	GTA San Andreas.exe
5892	GTA San Andreas.tmp
2152	GTA San Andreas.tmp

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTA San Andreas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTA San Andreas.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTA San Andreas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTA San Andreas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTA San Andreas.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	GTA San Andreas.tmp

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4460	msedge.exe

Inno Setup is an open-source installation builder for Windows applications. 7 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral1/memory/4244-624-0x0000000000A60000-0x0000000000B7C000-memory.dmp	innosetup
behavioral1/memory/5872-631-0x0000000000A60000-0x0000000000B7C000-memory.dmp	innosetup
behavioral1/memory/5320-634-0x0000000000A60000-0x0000000000B7C000-memory.dmp	innosetup
behavioral1/memory/4244-705-0x0000000000A60000-0x0000000000B7C000-memory.dmp	innosetup
behavioral1/memory/5872-707-0x0000000000A60000-0x0000000000B7C000-memory.dmp	innosetup
behavioral1/memory/5320-709-0x0000000000A60000-0x0000000000B7C000-memory.dmp	innosetup
behavioral1/memory/4244-720-0x0000000000A60000-0x0000000000B7C000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134276133138716355"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{1F5939AB-CE28-4884-B7AD-2D9A33E4ECF8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5760	msedge.exe
5760	msedge.exe
5892	GTA San Andreas.tmp
5892	GTA San Andreas.tmp

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 1640	5052	msedge.exe	88
PID 5052 wrote to memory of 4460	5052	msedge.exe	89
PID 5052 wrote to memory of 2792	5052	msedge.exe	90
PID 5052 wrote to memory of 2792	5052	msedge.exe	90
PID 5052 wrote to memory of 2792	5052	msedge.exe	90
PID 5052 wrote to memory of 996	5052	msedge.exe	91
PID 5052 wrote to memory of 996	5052	msedge.exe	91
PID 5052 wrote to memory of 3636	5052	msedge.exe	93
PID 5052 wrote to memory of 3588	5052	msedge.exe	94
PID 5052 wrote to memory of 3636	5052	msedge.exe	93
PID 5052 wrote to memory of 3636	5052	msedge.exe	93
PID 5052 wrote to memory of 3588	5052	msedge.exe	94
PID 5052 wrote to memory of 3588	5052	msedge.exe	94
PID 5052 wrote to memory of 1948	5052	msedge.exe	95
PID 5052 wrote to memory of 1948	5052	msedge.exe	95
PID 5052 wrote to memory of 1948	5052	msedge.exe	95
PID 5052 wrote to memory of 4492	5052	msedge.exe	96
PID 5052 wrote to memory of 4492	5052	msedge.exe	96
PID 5052 wrote to memory of 4492	5052	msedge.exe	96
PID 5052 wrote to memory of 3796	5052	msedge.exe	99
PID 5052 wrote to memory of 3796	5052	msedge.exe	99
PID 5052 wrote to memory of 3796	5052	msedge.exe	99
PID 5052 wrote to memory of 1736	5052	msedge.exe	100
PID 5052 wrote to memory of 1736	5052	msedge.exe	100
PID 5052 wrote to memory of 1736	5052	msedge.exe	100
PID 5052 wrote to memory of 4428	5052	msedge.exe	101
PID 5052 wrote to memory of 4428	5052	msedge.exe	101
PID 5052 wrote to memory of 4428	5052	msedge.exe	101
PID 5052 wrote to memory of 1760	5052	msedge.exe	102
PID 5052 wrote to memory of 1760	5052	msedge.exe	102
PID 5052 wrote to memory of 2392	5052	msedge.exe	103
PID 5052 wrote to memory of 2392	5052	msedge.exe	103
PID 5052 wrote to memory of 2708	5052	msedge.exe	105
PID 5052 wrote to memory of 3496	5052	msedge.exe	110
PID 5052 wrote to memory of 3496	5052	msedge.exe	110
PID 5052 wrote to memory of 3496	5052	msedge.exe	110
PID 5052 wrote to memory of 1168	5052	msedge.exe	111
PID 5052 wrote to memory of 1168	5052	msedge.exe	111
PID 5052 wrote to memory of 1168	5052	msedge.exe	111
PID 5052 wrote to memory of 4008	5052	msedge.exe	112
PID 5052 wrote to memory of 4008	5052	msedge.exe	112
PID 5052 wrote to memory of 4008	5052	msedge.exe	112
PID 5052 wrote to memory of 1736	5052	msedge.exe	113
PID 5052 wrote to memory of 1736	5052	msedge.exe	113
PID 5052 wrote to memory of 1736	5052	msedge.exe	113
PID 5052 wrote to memory of 3680	5052	msedge.exe	114
PID 5052 wrote to memory of 3680	5052	msedge.exe	114
PID 5052 wrote to memory of 3680	5052	msedge.exe	114
PID 5052 wrote to memory of 2160	5052	msedge.exe	115
PID 5052 wrote to memory of 2160	5052	msedge.exe	115
PID 5052 wrote to memory of 2160	5052	msedge.exe	115
PID 5052 wrote to memory of 5352	5052	msedge.exe	117
PID 5052 wrote to memory of 5352	5052	msedge.exe	117
PID 5052 wrote to memory of 5352	5052	msedge.exe	117
PID 5052 wrote to memory of 5508	5052	msedge.exe	118
PID 5052 wrote to memory of 5516	5052	msedge.exe	119
PID 5052 wrote to memory of 5508	5052	msedge.exe	118
PID 5052 wrote to memory of 5516	5052	msedge.exe	119
PID 5052 wrote to memory of 5516	5052	msedge.exe	119
PID 5052 wrote to memory of 5688	5052	msedge.exe	120
PID 5052 wrote to memory of 5688	5052	msedge.exe	120
PID 5052 wrote to memory of 5688	5052	msedge.exe	120
PID 5052 wrote to memory of 5204	5052	msedge.exe	122
PID 5052 wrote to memory of 5216	5052	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/6sh44we11bj84ar/GTA+San+Andreas.exe/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2c4,0x7ffcd763c188,0x7ffcd763c194,0x7ffcd763c1a0
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,12889198969149561166,1147861155757762598,524288 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,7577096845618707042,1233831815476678723,262144 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2504,i,13928500627549228569,6157370275572224413,524288 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,14988785589805893050,15301855744405207385,2097152 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,13729465280715456502,883552499809296611,2097152 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,157329701948625363,7694989426375581091,2097152 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,14656425770686799062,13596456951282238357,2097152 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5108,i,9516111396117403574,13006934308749247798,2097152 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5252,i,1793112296478517931,12049953198719840093,2097152 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5516,i,12917215690959343232,432180891182589053,2097152 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,5378108512127422243,16526146966851933967,524288 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,6525001894147782746,2322040604641987151,524288 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,3478931829748785240,4239433504828844225,524288 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,3478931829748785240,4239433504828844225,524288 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5888,i,17520522061565296207,322274875287611698,2097152 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5844,i,12080636229352859300,813029030288291333,2097152 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6844,i,9339836245053931265,15545591053640057992,2097152 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6804,i,6198916909858479697,1986829262586457827,2097152 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=6968 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7132,i,12595149890048681208,8577612095292404979,2097152 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7412,i,5183088951877289560,7757363065318325611,2097152 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=7304 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7584,i,2319274724319538156,16634874649232782093,2097152 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7732,i,4904539666482450092,15548229802125325623,524288 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:8
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7848,i,995208003650625494,6877118876591819216,2097152 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=7768 /prefetch:1
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=8280,i,149277984786216137,16576325261875548857,2097152 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=8276 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,14940117352147168273,273571146847074297,524288 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=8560 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,7522523730992777737,6150290219566057669,524288 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=8820 /prefetch:8
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4016,i,9466889117935021477,18157872451064062763,524288 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=8780 /prefetch:8
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7844,i,9528024699644774926,14254520086584684023,524288 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,7996468979695647130,16368651560949607352,524288 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7708,i,4701464527153818646,3510252152168694837,262144 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=7976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7928,i,15602471800005668689,3536630299471943778,2097152 --field-trial-handle=2340,i,16147177497693414651,6212773598976853430,262144 --variations-seed-version --mojo-platform-channel-handle=7896 /prefetch:1
  2⤵
  PID:2844
- C:\Users\Admin\Downloads\GTA San Andreas.exe
  "C:\Users\Admin\Downloads\GTA San Andreas.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4244
- - C:\Users\Admin\AppData\Local\Temp\is-VHLG6M3YLA.tmp\GTA San Andreas.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-VHLG6M3YLA.tmp\GTA San Andreas.tmp" /SL5="$D02E4,750205542,1099776,C:\Users\Admin\Downloads\GTA San Andreas.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1428
- C:\Users\Admin\Downloads\GTA San Andreas.exe
  "C:\Users\Admin\Downloads\GTA San Andreas.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5872
- - C:\Users\Admin\AppData\Local\Temp\is-8PIVFMEQFT.tmp\GTA San Andreas.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-8PIVFMEQFT.tmp\GTA San Andreas.tmp" /SL5="$1001F4,750205542,1099776,C:\Users\Admin\Downloads\GTA San Andreas.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:5892
- C:\Users\Admin\Downloads\GTA San Andreas.exe
  "C:\Users\Admin\Downloads\GTA San Andreas.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5320
- - C:\Users\Admin\AppData\Local\Temp\is-PSYVMUY5Z9.tmp\GTA San Andreas.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-PSYVMUY5Z9.tmp\GTA San Andreas.tmp" /SL5="$1D0022,750205542,1099776,C:\Users\Admin\Downloads\GTA San Andreas.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

is-RK8YULE4VZ.tmp

Path C:\GTA San Andreas\is-RK8YULE4VZ.tmp
Size 4.4MB
SHA256 249ecaf9d652944866a41c6eeb2bdf078afd3b5a27d5964eb4b680e3d626f419
MD5 b6f62bbd326799192f5d5275edf95c77
SHA1 ebe258ff9f2b4a9e7e20549c4b06569ebe55ec4a
SHA512 fee5eb15abaf80c5f319478e0393ed5199d1ce585dc9a2a00d30c93334394eee5fd9d8986bf2c3ae72b2a3acfc082e18286343f3692acb3244fa696af28c453f
SSDEEP 49152:yeGyzK5YtS9+SmpPvOwUNSdi1F9Nllz+mTslXkUE/2+X9lHuJBP4jo333REy:yeGwK5YHCNmi1F9NlJ+mwvE/2+Bs333H
TLSH
T14B266D13B288753ED7671EF67837A254983F7A203B11BC4A6AE40D8C8E3554CAD26773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 758df8d3fcc8153add0884f31eebee2a2577adda6817b51a21944c2f22794229
MD5 dfe64ea383e58df01fbdd8c6865b3a83
SHA1 64d0ff086bd183d34c0b6b57979d47d1fe496dd7
SHA512 524a90cba89216a298c0432d24ac36c2e9c4be3586290c83a8e424408da052cee2b563929aeda73dc89ea7e7dbb596e97fee811e69b8a48e16ebaa5a39d7063e
TLSH
T1BFD0A73076696C96D538147194314701BEA58556219A96066144840D5C796C2B68A5A2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 5e4ec0102742d95759964b3fdda086e1dcdcc90f5b15ad80dafa409eed304e3e
MD5 730e35dc5faedc82e3704b214f574c6e
SHA1 30ffb82a539ae2d9f5ae5b9cbb0afb4cedbb21b1
SHA512 82a001a811c16c94e1315132e2366792829ee2553e7825e3638bc8ede602e8f99e6bdfa2dee3b3f22ad293bea6e781159f18a07588869d83983ec78960ee341c
SSDEEP 96:01WPHXa/C6sKLi62WMw4kSa9tHZeM9DvmVkC:04P3aK6Ni6uw4kt9XekC
TLSH
T160B197EE128331BAD765023DCDEE0E15F974C8B446EB6D09A156B47C82D3F9181D9D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 f028297e04a3ab52594137bde5a28339f8c2dc3f70312b38cd49b9c4aebadf9a
MD5 6113893172c21fa087554d40730f0e7c
SHA1 d9923ac6485eb5c8d31438cb606e2661a49afd63
SHA512 277e96e0fe1504f8bcdf3f1112f211f423aa1adcc3dad0ef34c60fe0e53da0a22ccce2994f5202f6228f674655dd66049a8484b51023c88535c4d885620b36db
SSDEEP 96:zt1WPHXa/C6sKLi62WMw4OSa9tHZeM9DvmVkF:zt4P3aK6Ni6uw4Ot9XekF
TLSH
T1BCB1A7EE128331BAD765023CCDEE0E15F874C8B446EB5D09A156B47C82C3F9141D9D0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e990.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e990.TMP
Size 3KB
SHA256 9e1cd22be69e4ee523c722dc612440c9106ec857812e798825d3547634a57cdc
MD5 cefa24fca0f916bb5e9ba179cae36e73
SHA1 e57b07c45c09f8b163a548cc7fb0fadc7e844e63
SHA512 ae7fb45a8a84897ee1bb1d96f165cd36476e15f257f68fac57b799e32c31eb1bde1dbf3ffc3622fcab394b77a6afde55790aa6cbaf175f46691d9f1a352ab249
TLSH
T1EC713D7F0293307ED7612231CDDD1A05F9B5C88549FF9D0AF146B57C86A375285EA818
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 29KB
SHA256 c9fbd3df3926c9ba7b04ce08fc662e00cf6e26e813beb0efe47572da8c42b786
MD5 c0aaea5201b96fcac6ca0e5958b143e8
SHA1 80c53f07abdb8bc5e75e36c3ec99a7424d918dcb
SHA512 551844d677f1c324896298660cda62688c62bcde2b538c11c8a4f80655302811b510be2fc7d22bd64a778b1d4d135d0b84160f552f1a6454acb3345b7ab81582
SSDEEP 384:DmbIrScIC1TvB4BeQDqlejJpY3M3Nvie/enWl87CHJV4FZBe+pexay4Iur476YTu:erUrqxssG8OK4ka0w4cEE
TLSH
T17FD257F383E5D56E89115BF85614AE1BCF1C1619832C3C2589D5EE8BE3E2032E16E64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 37d11553ca0fa476c9ecaf4d7f94aa556e01efe8f713d9f64647b26fa5746658
MD5 b799dc083b8ec0722cc0de8c63774904
SHA1 4ae38325f81006998d11956edc78e756dd26c2b6
SHA512 239da2a05697884af4c493f7871a77422197fba96ef09bf903b0dda41b228e68f4094d2a9d3fa20e528f731441525b9490e4f2b0ffccf2ce5ac0440bf97f498a
SSDEEP 192:sxZHRbyM/jK1Ml8MVuH/f+st/gLb3IIdp8dHW6+WNmSX/YweXuIIgrJ:sxZH1duH/f+st/aj5YHbX/k9
TLSH
T1ED42F8126A34997BCCCBD209FA55BB53D6F50572E2900E44AAFCDA0C05E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e4bdde3528fc690e824f5a381e1c7228cecd71aaae801a5d08b3e3a3a9a48ecb
MD5 f2dc162d11aa72b0f3885fae9614ea6f
SHA1 9503360539c62ac282b56fbf37881f92d6ee351e
SHA512 f98521bd0e9e545196cb1b9c838709cb80aaeed85d495cc2f712785204517ca74b61d6fc20fe576dba77f0a1efadef9792179ab2464f3f924e641fd40dfc1a9d
SSDEEP 192:sxZHRbyM/jK1Ml8UQ7oH/f+sW/gLb+IIdpbimuVMldHW6+WNmiCguZYwqauIIg55:sxZH1q8H/f+sW/aK5et27HbXgZr3
TLSH
T14062F813A6349977CCDBD219FA45BB53D6F50472A2904E44AAFCDA1C05E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2d67d578e44bcb7d903d0b40e4869d8de0480f31876700fc47c12011aa795fc9
MD5 5318b18bd5693e411b596bbc9d0860a9
SHA1 78fedf6331cce5045fad6df2bf619e4cb8dd1d7e
SHA512 0aea5b54fc228652be7f30c9d154f70b0998c6718c0c2664f3cc36284468d3b7761cbb5065c17037162326716c2efba29537396b53e7ba93ac2b74cbecfe87f7
SSDEEP 192:sxZHRbyM/jK1Ml8MoH/f+sW/gLb+IIdpVimuVMldHW6+WNmiC+wqaXYwNhxuIIgR:sxZH1AH/f+sW/aK5It27HbXbhaXPNR
TLSH
T14A52E912A63499778CDBD219FA45BB53D6F90472E2904D44AAFCDA1C05E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5ff6404d7e8ab8b4753db86deb88d88b3116dd8ca25a5930918d91b9bb6749a7
MD5 7643cca3657e05fbbc24fb9987075dc8
SHA1 6d5d1c596f82dc85291f640c5f163d196f482cda
SHA512 f64e9637bb97cb0b108f39431e8ab189bf199d6164390c1ad2b5b24887d2170902b81fadbb8c6e419fb29a9e3f5e02ec085e3f2ccd81f7e4353259241bc145e7
SSDEEP 192:sxZHRbyM/jK1Ml8McvH/f+sW/gLb3IIdpVimuVMldHW6+WNmiCSX/YwetuIIg59J:sxZH1kvH/f+sW/aj5It27HbXD/mR
TLSH
T13B52F913A63499778CDBD219FA45BB53D6F90472E2904D44AAFCDA1C05E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d351d4e7fc7194c651e02f51ebc1d81303ba6acc7ad8cd5d3aab200755b45049
MD5 e6db0b9727a02421ca9d4bb39417c59c
SHA1 dd6a3ca9abc0b040c80e392d98b8b93d40d43d30
SHA512 7ad1d9f91c4c9322952852ce82887e4ece127b14e34425f7c3a282ae0555f6bcba65333043f4effa600c0de7174fc678dbeda8cd9c1d4526d73c4488c025e529
SSDEEP 192:sxZHRbyM/jK1Ml8MmH/f+sW/gLb+IIdpVimuVMldHW6+WNmiC+wqaXYwNhluIIg3:sxZH1eH/f+sW/aK5It27HbXbhaXPR3
TLSH
T14C52E912A634597BCCDBD219FA45BB53D6F90472E2904E44AAFCDA1C05E7BDD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f6e26e9bbcc18bb92554d295f84e12c44329493a715ffcdf87b5624dce128a86
MD5 12af5de7b569a64910ad9d18a3f25792
SHA1 f432b1421692d0672a897b3b561317098488246a
SHA512 1f8419c7b731f705d2a5fd738b4443f79b44bde09d2488494ef6e3dcc29f25e632ffe09e6288d5576d41ab9281a65423609c29a64d2004e2a9226359f8d340df
SSDEEP 768:yH4jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dVrohNuam:yH4jeXmWvmKxEu1jacPLZQduw
TLSH
T1DAE20A3B240CCF7E4F844E5DED26AE976ED801CB6A588D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72ea5885e5f7e2de_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\72ea5885e5f7e2de_0
Size 63KB
SHA256 7fd88de7852c4566c0d136bc56b496d3f1c05d6308cdaf2a7dfac53f2b772ff4
MD5 af4ae2553ec437fb6e3fb2e008a4a243
SHA1 68bad4d04d82ccf462b72838cda35fd432a5aa57
SHA512 920e7ec67fbee3f920e19a8ae1bf904a1d718f7c499bae6061949d4e6e2ffb70192ccb5ab087d260420f8f24a6469011284ae3acd99806964d1c854c801f138a
SSDEEP 768:FeJDcwZ9olHJrD05l7eEFfgoAxWhrJTV9/5oZ+UyA2xGu/5374WAiEAXnR8c6BVy:FDJ0VPVR5yyJxGSV4V1C6c0VVEO
TLSH
T189534BA633707477827BA1F1905F130B713AE167F40494E8B194EEE54A84BAA42B7F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 9a2e0d334ef2f87cb41d8e9526a6b43bb01c77d80d9c819c3cc67aaf3f4355c3
MD5 170ac827da204395ff5bd5ad7e31a551
SHA1 53a6755d728bcf27e1df624aae95902d692e5633
SHA512 dd65ea13fc297f354224793581bf85156b05f32ceb4aac77fc78a171dc5f7d0094dfb287039b4892c8d1bcba1dc5bba3eb23132a77aee7d40de0c423477352cc
TLSH
T1F0A002D171544001D12446755081C2417265AC68412D621661D16C5B8854580898641E
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 90abd99bb82f822445399cc355307b65ed340e114c56d80796b9f6d6c42b665f
MD5 f03eb93409b1e3e260b5f9a2ef893032
SHA1 8d651713ffe13cd2e6c8c2b825780402167f95c1
SHA512 2ddb05b37c57d1d6f098eca6eb00db8bfe633dff12e6648f4c3985b995cd810b0594bbfcfc11e0f55426f582baf50863302b5363f45a0e29decba70691e7909e
SSDEEP 96:KQLeK0I22bSKc0YYp8IamqwWuzjgwwK4lgSwcgwDyYdHbEBVj5J1WdSIg91K4EgK:41pbYp8IamqXuzcwElgSPgwDyYdHbEBk
TLSH
T1C4B16456327B02112C7E291891A19B2757C3B1733218A43B3BB951B24E6BE639CFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e807ae18-98b0-40e8-9d74-c9048f6bab90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e807ae18-98b0-40e8-9d74-c9048f6bab90.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2a840689f523b7cca9daf745c98ac407024a96e4940e0d72dc73cca5c10bdfb0
MD5 08b53e3d57be079393b0c87d0bd77ed1
SHA1 75fb464f43aeffae82dab66c4c8252e3880ef6fe
SHA512 46e1a69da49bbd6d7c0bcf0367d3cab2c81e8c09353e793e1a83654b5e64cefe6f8dc0c4e6d48a27303c12d687b96978a8f25817ccbdd7a71c7f3bd5e530ee79
SSDEEP 384:ztNn/s3n9SosNiX0v1df+5OMYHo5vFbOObjI9G6w7eUV:zj+9j6dkOPo5tb29MV
TLSH
T160928D325828AD374D929656F44B3A178FF8816BE6C53F84D6DC7F0E01CB6EC530A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 bcc852ea67ff2052f21e79e761d38504bcaeb212e96a2fb37f33357e7966c696
MD5 a630325116b23781cb9231add6f121c8
SHA1 3d1dde770bfb09cff394411e90632ca4134dd77a
SHA512 d2ebf12797d99a6dc386a2d6998a4ab15017e143c143cb6fe8c66a430f0716cc2f46f408a3bd7802d99799023ffa55024e0ae752eb770daad8d87b4b91d06945
SSDEEP 384:3iFKtNn/s3n9SKSsN68TUNTUlIl801Bdf+5OMYHo5pFbOObjI9G6w7eUV:yFKj+9kLwg/dkOPo5Db29MV
TLSH
T1D9A26B335858DD7B9DA28A96F94A36178FF441ABD6C5BE84E6DC6F0D01CB2EC130AC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 e19068a07d65acd68751bbbb8b97eb64e94347aff42b6be63ff75302425972fb
MD5 9bb3e2cef01363c7bb4a0a1808dd2b39
SHA1 b701da81f1c6edfd5c87fc3b5fab29870bfe3d3d
SHA512 d16605a2b7ca33f54a77c31b3525a0131d9674fd966791a3e7abd0710ccf47178b7bd646052043bb9b0861c8a02be7325a64bd6bd9ab5f15ac7c91c7c93926ff
SSDEEP 384:3iFgtNn/s3n9SKzQbsNJ8TUNTUlIl803Bdf+5OMYHo5LFbOObjI9G6w7eUV:yFgj+96bywghdkOPo55b29MV
TLSH
T199A26B339858DD3B9DA28A96F94A36178FF441ABD6C5BE84E6DC6F0D01CB1EC130AC14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cbd7fefde0682984666819308b159aa3222d167519db92634a4ba1fca5351bf9
MD5 53c9799d38c98b8c8da070b31bf7315e
SHA1 31a073acdee21ee8677cb62bd3398de7084daaf2
SHA512 8437c99f8dd4ca26787f0fe987957917d298192e00803fb013f70a2dfcffe44b3e27986aeb960436b63d2a4e2b0c40e97317f378fdb96ed26b04be0cbb218927
SSDEEP 192:EONU6hZ0QmiUy9Mpc/+jVnO1GYc5wOZ9LU6:EONU6oBpu+5OMYj2NU6
TLSH
T11602E93568686C778EE2AE46F48737235FE4112BE9D56F84DAE82B1D00C769C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a6025aa6259db8f66175e2ce1460a6f0474768013301b46b42c0ed58d945eeeb
MD5 6973a78bc08c46031ddd742fe4d72292
SHA1 9cbd06ee658c8a553a13bfaaee40497e05f73ac4
SHA512 90a5a9e8ca9b537922df263b65239013f969f6dfb64c1cd26c9c6b961f7531ee1eb36e33ba20b1ef365ad7450dcaa77bf3c6f61474368ee5f9c32b03ff1fe9bd
SSDEEP 384:EtNn/s3n9S+sNi801Bdf+5OMYHo57FbOObjI9G6w7eUV:Ej+99LdkOPo5pb29MV
TLSH
T135927C325828AD368D929656F44B3A178FF8916BE6C93F84D6DC7F0E01CB6AC530A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bb99bcaaa64269b941a7af6e851fa8f049344d36d4a4113dbc3bd314d29c1d71
MD5 2d591cb4f7321568d98e8334d27efd39
SHA1 9a298e6b71e0d21f9b76ea67ef5b67ac6be2a9d0
SHA512 557edc47a505d1da879513effeedbf4261ebeb0c6fb81868b336653f87a559dab68d9a4ca017c6c114525b8fe6af0efd44ed8b8271427d7a81a049eda9f1ac7f
SSDEEP 384:ztNn/s3n9SYsNi10iBdf+5OMYHo5vFbOObjI9G6w7eUV:zj+9/7dkOPo5tb29MV
TLSH
T100928D325828AD378D929656F84B3A178FF8916BE6C53F84D6DC7F0E01CB6EC530A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d4bb6b7d2e5d3a5d669fa0771ef31d71bd17276919cf9730c7ea0676a29ed1d0
MD5 f1c9589ab8a35071e8acfd5375df7401
SHA1 45e77e140e0492397637e51022f976bf62ae72f8
SHA512 dc40c7dcc2d562cdac5917ecdd89a39242ee658e619cbf1f221722f8367143302c04e1f6a9b4c38532ce6ffc43899a4830a8c45808d47813fca992bd3723ba38
SSDEEP 192:rONr6hZOQmiUydMNc/+jVnO1GYHLE5x5cOquqHU6:rONr6O/Nu+5OMYHo5U9bU6
TLSH
T1FA120A326868AC774DD2AA46F48736138FE5512BEA85BFC4D6DC3F1C05DF6AC230A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3be9d7f0-d51a-4ff5-96af-11a661238100.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3be9d7f0-d51a-4ff5-96af-11a661238100.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 31392bd891443e6ca48d341b92a0becd5656a9ccae7298824efdca79e3984078
MD5 a1b0cea7e0bb976f1210125f8ef149f9
SHA1 8e6d3aff66a648fec1f94da36653c4fb9279d50f
SHA512 f2d5a613222495ccd04a6b20211815f579be20e551c3f43c5b630a1a44871e2f772beb3960898c55bf1943e9be93f8648420ff9d4421efc9a8f679ae9c697c8e
TLSH
T11241C558A6E91148B3B76F569BF768AD447ABC772E06845E10110E4F0A62B40C9A2737
MD5 SHA1 SHA512 TLSH

Submit Download

GTA San Andreas.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-VHLG6M3YLA.tmp\GTA San Andreas.tmp
Size 4.4MB
SHA256 f6a01fe2163d50e92928b3763eec38db161624a0356f201761e1416bcd6feb3f
MD5 4bdef521987a0f42baaefb8d0d49bf93
SHA1 0c59495e345b36c6de207a61a39a2ccfe1f8954e
SHA512 6bb517be66bcadb14acb3050ddbf28ea8d603fe02aeb94061282ba50247a12460ef144b31a02c31b4ccb24d7591c52b129383c0e711315a2e08983499e7f2a42
SSDEEP 49152:KeGyzK5YtS9+SmpPvOwUNSdi1F9Nllz+mTslXkUE/2+X9lHuJBP4jo333REP:KeGwK5YHCNmi1F9NlJ+mwvE/2+Bs3336
TLSH
T12D266E13B288753ED7671EFA7837A254983F7A203711BC466AF40D8C8E3554CAD2A673
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1428-719-0x0000000000890000-0x0000000000D06000-memory.dmp

Download

memory/1428-706-0x0000000000890000-0x0000000000D06000-memory.dmp

Download

memory/2152-708-0x0000000000DA0000-0x0000000001216000-memory.dmp

Download

memory/4244-705-0x0000000000A60000-0x0000000000B7C000-memory.dmp

Download

memory/4244-624-0x0000000000A60000-0x0000000000B7C000-memory.dmp

Download

memory/4244-720-0x0000000000A60000-0x0000000000B7C000-memory.dmp

Download

memory/5320-634-0x0000000000A60000-0x0000000000B7C000-memory.dmp

Download

memory/5320-709-0x0000000000A60000-0x0000000000B7C000-memory.dmp

Download

memory/5872-707-0x0000000000A60000-0x0000000000B7C000-memory.dmp

Download

memory/5872-631-0x0000000000A60000-0x0000000000B7C000-memory.dmp

Download

memory/5892-710-0x00000000006C0000-0x0000000000B36000-memory.dmp

Download

memory/5892-746-0x00000000006C0000-0x0000000000B36000-memory.dmp

Download