hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/FreeYoutubeDownloader[.]exe

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 18:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/FreeYoutubeDownloader.exe

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation	FreeYoutubeDownloader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation	FreeYoutubeDownloader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation	FreeYoutubeDownloader.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\Control Panel\International\Geo\Nation	Free YouTube Downloader.exe

Executes dropped EXE 15 IoCs

pid	Process
4116	FreeYoutubeDownloader.exe
4596	Free YouTube Downloader.exe
4884	FreeYoutubeDownloader.exe
2524	Free YouTube Downloader.exe
4592	Free YouTube Downloader.exe
3952	Free YouTube Downloader.exe
680	Free YouTube Downloader.exe
1872	Free YouTube Downloader.exe
3776	Free YouTube Downloader.exe
1492	Free YouTube Downloader.exe
3040	FreeYoutubeDownloader.exe
2216	Free YouTube Downloader.exe
2012	Free YouTube Downloader.exe
2452	Free YouTube Downloader.exe
3484	Box.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe"	FreeYoutubeDownloader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe"	FreeYoutubeDownloader.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1790404759-2178872477-2616469472-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Free Youtube Downloader = "C:\\Windows\\Free Youtube Downloader\\Free Youtube Downloader\\Free YouTube Downloader.exe"	FreeYoutubeDownloader.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
57	raw.githubusercontent.com
58	raw.githubusercontent.com

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe	FreeYoutubeDownloader.exe
File opened for modification	C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe	FreeYoutubeDownloader.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 827411.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
4548	msedge.exe
4548	msedge.exe
1688	identity_helper.exe
1688	identity_helper.exe
4932	msedge.exe
4932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of FindShellTrayWindow 47 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4596	Free YouTube Downloader.exe
4548	msedge.exe
2524	Free YouTube Downloader.exe
4592	Free YouTube Downloader.exe
3952	Free YouTube Downloader.exe
680	Free YouTube Downloader.exe
3776	Free YouTube Downloader.exe
1872	Free YouTube Downloader.exe
1492	Free YouTube Downloader.exe
2216	Free YouTube Downloader.exe
2012	Free YouTube Downloader.exe
2452	Free YouTube Downloader.exe

Suspicious use of SendNotifyMessage 35 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4596	Free YouTube Downloader.exe
2524	Free YouTube Downloader.exe
4592	Free YouTube Downloader.exe
3952	Free YouTube Downloader.exe
680	Free YouTube Downloader.exe
3776	Free YouTube Downloader.exe
1872	Free YouTube Downloader.exe
1492	Free YouTube Downloader.exe
2216	Free YouTube Downloader.exe
2012	Free YouTube Downloader.exe
2452	Free YouTube Downloader.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4116	FreeYoutubeDownloader.exe
4884	FreeYoutubeDownloader.exe
3040	FreeYoutubeDownloader.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4548 wrote to memory of 2360	4548	msedge.exe	41
PID 4548 wrote to memory of 2360	4548	msedge.exe	41
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 4940	4548	msedge.exe	87
PID 4548 wrote to memory of 1656	4548	msedge.exe	89
PID 4548 wrote to memory of 1656	4548	msedge.exe	89
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88
PID 4548 wrote to memory of 4492	4548	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Trojan/FreeYoutubeDownloader.exe
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4fe246f8,0x7ffd4fe24708,0x7ffd4fe24718
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe
  "C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:4116
- - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
    "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4596
  - - C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe
      "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe"
      4⤵
      Executes dropped EXE
      PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,1799407227213626947,2347249985289365508,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6400 /prefetch:1
  2⤵
  PID:3680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3300

C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe
"C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4884
- C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
  "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2524

C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4592

C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3952

C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:680

C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1872

C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3776

C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1492

C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe
"C:\Users\Admin\Downloads\FreeYoutubeDownloader.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3040
- C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
  "C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:2216

C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2012

C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe
"C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3bde7b7b0c0c9c66bdd8e3f712bd71eb

SHA1
266bd462e249f029df05311255a15c8f42719acc

SHA256
2ccd4a1b56206faa8f6482ce7841636e7bb2192f4cf5258d47e209953a77a01a

SHA512
5fab7a83d86d65e7c369848c5a7d375d9ad132246b57653242c7c7d960123a50257c9e8c4c9a8f22ee861fce357b018236ac877b96c03990a88de4ddb9822818

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9cafa4c8eee7ab605ab279aafd19cc14

SHA1
e362e5d37d1a79e7b4a8642b068934e4571a55f1

SHA256
d0817f51aa2fb8c3cae18605dbfd6ec21a6ff3f953171e7ac064648ffdee1166

SHA512
eefd65ffcfb98ac8c3738eb2b3f4933d5bc5b992a1d465b8424903c8f74382ec2c95074290ddbb1001204843bfef59a32b868808a6bee4bc41ee9571515bbac6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25620a44-0802-481a-b13f-2c5e81f191b5.tmp

Filesize
6KB

MD5
6cd271a89ce4d5ade0c3ae73f609198b

SHA1
4d8779ada4f14bc6719d57fbed7978578056a458

SHA256
e179619b5ee6f7a9d55bbfdfe3ff8b4e2c6d618e0d5ee150eae261725918772f

SHA512
1227420b77a2987401215537ca18fa63d5c67590810fc4e262d3caeaeba38a1cf18edf3ec68dd42662ce4a9ecf1e16c058f809a3d3be11f8cb5f13bf1b3fc91e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3d6bf3a595ee22812202d9b964a390eb

SHA1
5674c0f4146ef5c53732a4f839c5085506613d96

SHA256
d83f7013dab341d20d627b7a60a66776d8d878499f6a2e8e83b23864c72961bf

SHA512
3a64277d2aec1cb1422c919d9ff14ecd3f9a2d26f81730246a2f776a38d31ec1e272185d3123f6fc6a55881e7e8db3f683d79bfbef5123c724766d539c1f0edd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
579B

MD5
0a8a7c3dafeb4ad3d8cb846fc95b8f1c

SHA1
69e2b994e6882e1e783410dae53181984050fa13

SHA256
a88495f2c1c26c6c1d5690a29289467c8bb8a94bf6f4801d2c14da1456773f90

SHA512
2e59b4cd4cf6f86537aae4ae88e56e21abcff5070c5c1d1d2105a8e863523c80740438cc36b2b57672bc7bb7fb9387896135afcce534edfd4697fecf61031a5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8a2a7fbf64b3559e6dbda7f69ccc5251

SHA1
46a174cf98fda172c4a117d6b56adc4badf4890a

SHA256
f2f6694b63896a560d350e13276553e00f7c68f8d44c8e1d9129f9ecd914e3ac

SHA512
7b0384301dcd6e3e33e5f9642a888b16985c2d87f815a1d51b97539f87abd00ead53158dc6b9e73dc67d0aae70ec85f0968b82d75ce6ef60b89547f3ffbf78ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0a44e3ad99fb52ab9eb8e3a54369510a

SHA1
7a8fa2c812200067e02357d192c8311b3a11e62e

SHA256
7e2d3f44fca88b4d3f005906b178300eb97cc963b049020dce3ad1fbf868f78b

SHA512
bd99f17721aab75e7926c95f7684e6f7daf9141c829650836ac76d6b9ae4d721bae1ddb617cfac7d84c2e62849bc01a58c6b94716e4785f2a20fec11f4b981d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9a2692e770e568755f3710567ba2c68d

SHA1
91473b189956f801e425a1b3e2c283c1046dcc70

SHA256
d83b9e06f8b8d2a7406956f3b5253947b2c2005505d94c9df8e2e36f9a99e056

SHA512
bcd6195aea28ab25fcfe0cd581ba935650040e1845c206683b185bcb6c48fee8e5ff896616a04295fe3d4d1536062d3eee85061cd3026c7348869aede4f585a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
70b41e39da7efb1225b2db98f94c583c

SHA1
009bce5703f7580dd487279362fe2a81a0234a83

SHA256
0a9c67019317f360c81a364f60a825b154e2a05411885b1866b8c68606773624

SHA512
47b0e083478d3e5b5e1613f9364fecd2d370419ceb27fee306a7ed04629db5bb0a9233fe2d650ffd100895bf3a269fbd309fd899cc1ab8893a0ec0929f014c58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6cc2d97df56b2f11c456682f5456938b

SHA1
8f8495505091779bfa35abcea961849f77b3c4c8

SHA256
b2a446cc1aa26fee8083c2f924ad8f2f10cc7b3a2e42edea989bbe2bec2465c0

SHA512
9f01e7e2805bd12cc3ce1c7b0d775d00ebc884741568569b6759255ecfab179e07346adec68aede9003a86e78cc67010534a3064031396ee4a2659c346cf5509

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\2.tmp

Filesize
36B

MD5
8708699d2c73bed30a0a08d80f96d6d7

SHA1
684cb9d317146553e8c5269c8afb1539565f4f78

SHA256
a32e0a83001d2c5d41649063217923dac167809cab50ec5784078e41c9ec0f0f

SHA512
38ece3e441cc5d8e97781801d5b19bdede6065a0a50f7f87337039edeeb4a22ad0348e9f5b5542b26236037dd35d0563f62d7f4c4f991c51020552cfae03b264

Download Submit
C:\Users\Admin\AppData\Local\Temp\$inst\temp_0.tmp

Filesize
176KB

MD5
bc82784f4aa47bcfed93e81a3b9950f2

SHA1
f5f2238d45733a6dde53c7b7dfe3645ee8ae3830

SHA256
dd47684334f0a2b716e96f142e8915266d5bc1725853fd0bdc6d06148db6167f

SHA512
d2378f324d430f16ce7dcf1f656b504009b005cdb6df9d5215fe0786c112e8eba8c1650a83192b6a9afad5892a1a456714665233f6767765619ccb5ff28e2b8a

Download Submit
C:\Users\Admin\Desktop\Free Youtube Downloader.lnk

Filesize
2KB

MD5
c46d0c6fa2a8fa622adec56ce7da63dd

SHA1
13e3f68eb77f6e88ccfa4ea7397317a87c78ed49

SHA256
438993af75242a4c23141a81770a85e74512fd603925484758f112039a546cdd

SHA512
97b34cbd67d6732841609d2780ec35ed7b2555a0771bedc6ca3c979236b85fb2f8a3cc39be96058cad518dfd387569f377c4cc894678c9fd88fbc42d99ef36f8

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 827411.crdownload

Filesize
396KB

MD5
13f4b868603cf0dd6c32702d1bd858c9

SHA1
a595ab75e134f5616679be5f11deefdfaae1de15

SHA256
cae57a60c4d269cd1ca43ef143aedb8bfc4c09a7e4a689544883d05ce89406e7

SHA512
e0d7a81c9cdd15a4ef7c8a9492fffb2c520b28cebc54a139e1bffa5c523cf17dfb9ffe57188cf8843d74479df402306f4f0ce9fc09d87c7cca92aea287e5ff24

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Box.exe

Filesize
438KB

MD5
1bb4dd43a8aebc8f3b53acd05e31d5b5

SHA1
54cd1a4a505b301df636903b2293d995d560887e

SHA256
a2380a5f503bc6f5fcfd4c72e5b807df0740a60a298e8686bf6454f92e5d3c02

SHA512
94c70d592e806bb426760f61122b8321e8dc5cff7f793d51f9d5650821c502c43096f41d3e61207ca6989df5bfdbff57bc23328de16e99dd56e85efc90affdce

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Free YouTube Downloader.exe

Filesize
153KB

MD5
f33a4e991a11baf336a2324f700d874d

SHA1
9da1891a164f2fc0a88d0de1ba397585b455b0f4

SHA256
a87524035509ff7aa277788e1a9485618665b7da35044d70c41ec0f118f3dfd7

SHA512
edf066968f31451e21c7c21d3f54b03fd5827a8526940c1e449aad7f99624577cbc6432deba49bb86e96ac275f5900dcef8d7623855eb3c808e084601ee1df20

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.exe

Filesize
110KB

MD5
ab648a0df4fe7a47fe9d980c545b065d

SHA1
ce28ea7dd117289daf467467a592bc304c72d4e6

SHA256
905a849721ec95ab08754aeee9a60b3ed435d36962466fcbe5cfca63dfc455cd

SHA512
7ae99da55fbf1c31c5281e5f4e10ab2bc33b89effeee82b574eb4b60541c5ea2913d5d99836608873da372c78e75436ae7e535568f48d81cb9dd26d2cc1b3a8c

Download Submit
C:\Windows\Free Youtube Downloader\Free Youtube Downloader\Uninstall.ini

Filesize
3KB

MD5
c92a1d4d0755c886dd137c6cab43c35e

SHA1
fc16175e58ad1f67c57e7fdf55333fdd0e01d936

SHA256
6ab1ee65e6c9c5e31fe3680fc92a2a0ae73f216e966f5582a2d9c265357238d4

SHA512
0525880a1f4cc7dd912ca4006fe4bd02bf1218931fcb56489a0ec728a682fdf1ecd35e8797c665c63dc19d8236942d9b832a6a8c46e00df02afa2c65327dd9de

Download Submit
memory/680-383-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/680-384-0x000002156FFA0000-0x000002156FFB0000-memory.dmp

Filesize
64KB

Download
memory/680-397-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/680-399-0x000002156FFA0000-0x000002156FFB0000-memory.dmp

Filesize
64KB

Download
memory/1492-407-0x0000023C6FE00000-0x0000023C6FE10000-memory.dmp

Filesize
64KB

Download
memory/1492-406-0x0000023C6FE00000-0x0000023C6FE10000-memory.dmp

Filesize
64KB

Download
memory/1492-405-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/1492-398-0x0000023C6FE00000-0x0000023C6FE10000-memory.dmp

Filesize
64KB

Download
memory/1492-396-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/1872-388-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/1872-404-0x0000021738CC0000-0x0000021738CD0000-memory.dmp

Filesize
64KB

Download
memory/1872-400-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/1872-393-0x0000021738CC0000-0x0000021738CD0000-memory.dmp

Filesize
64KB

Download
memory/1872-389-0x0000021738CC0000-0x0000021738CD0000-memory.dmp

Filesize
64KB

Download
memory/2012-440-0x000001F14DD30000-0x000001F14DD40000-memory.dmp

Filesize
64KB

Download
memory/2012-452-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/2012-436-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/2012-437-0x000001F14DD30000-0x000001F14DD40000-memory.dmp

Filesize
64KB

Download
memory/2012-455-0x000001F14DD30000-0x000001F14DD40000-memory.dmp

Filesize
64KB

Download
memory/2216-442-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/2216-444-0x0000022167390000-0x00000221673A0000-memory.dmp

Filesize
64KB

Download
memory/2216-432-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/2216-433-0x0000022167390000-0x00000221673A0000-memory.dmp

Filesize
64KB

Download
memory/2216-434-0x0000022167390000-0x00000221673A0000-memory.dmp

Filesize
64KB

Download
memory/2216-445-0x0000022167390000-0x00000221673A0000-memory.dmp

Filesize
64KB

Download
memory/2452-456-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/2452-439-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/2452-441-0x0000026550670000-0x0000026550680000-memory.dmp

Filesize
64KB

Download
memory/2452-443-0x0000026550670000-0x0000026550680000-memory.dmp

Filesize
64KB

Download
memory/2524-370-0x00000202F1F10000-0x00000202F1F20000-memory.dmp

Filesize
64KB

Download
memory/2524-371-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/2524-369-0x00000202F1F10000-0x00000202F1F20000-memory.dmp

Filesize
64KB

Download
memory/2524-368-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/2524-374-0x00000202F1F10000-0x00000202F1F20000-memory.dmp

Filesize
64KB

Download
memory/2524-375-0x00000202F1F10000-0x00000202F1F20000-memory.dmp

Filesize
64KB

Download
memory/3040-431-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/3484-453-0x00000000055D0000-0x00000000055E0000-memory.dmp

Filesize
64KB

Download
memory/3484-448-0x00000000009B0000-0x0000000000A24000-memory.dmp

Filesize
464KB

Download
memory/3484-449-0x0000000075090000-0x0000000075840000-memory.dmp

Filesize
7.7MB

Download
memory/3484-450-0x0000000005AA0000-0x0000000006044000-memory.dmp

Filesize
5.6MB

Download
memory/3484-451-0x0000000005400000-0x0000000005492000-memory.dmp

Filesize
584KB

Download
memory/3484-454-0x00000000054C0000-0x00000000054CA000-memory.dmp

Filesize
40KB

Download
memory/3776-390-0x000001F3F3160000-0x000001F3F3170000-memory.dmp

Filesize
64KB

Download
memory/3776-403-0x000001F3F3160000-0x000001F3F3170000-memory.dmp

Filesize
64KB

Download
memory/3776-402-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/3776-401-0x000001F3F3160000-0x000001F3F3170000-memory.dmp

Filesize
64KB

Download
memory/3776-391-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/3952-394-0x0000014EAFBB0000-0x0000014EAFBC0000-memory.dmp

Filesize
64KB

Download
memory/3952-378-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/3952-379-0x0000014EAFBB0000-0x0000014EAFBC0000-memory.dmp

Filesize
64KB

Download
memory/3952-380-0x0000014EAFBB0000-0x0000014EAFBC0000-memory.dmp

Filesize
64KB

Download
memory/3952-392-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/4116-202-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4592-386-0x000001BCFDB70000-0x000001BCFDB80000-memory.dmp

Filesize
64KB

Download
memory/4592-373-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/4592-382-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/4592-376-0x000001BCFDB70000-0x000001BCFDB80000-memory.dmp

Filesize
64KB

Download
memory/4596-204-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/4596-203-0x00000147EF260000-0x00000147EF28E000-memory.dmp

Filesize
184KB

Download
memory/4596-205-0x00000147F1950000-0x00000147F1960000-memory.dmp

Filesize
64KB

Download
memory/4596-215-0x00000147F1950000-0x00000147F1960000-memory.dmp

Filesize
64KB

Download
memory/4596-340-0x00007FFD4BD40000-0x00007FFD4C801000-memory.dmp

Filesize
10.8MB

Download
memory/4596-346-0x00000147F1950000-0x00000147F1960000-memory.dmp

Filesize
64KB

Download
memory/4596-347-0x00000147F1950000-0x00000147F1960000-memory.dmp

Filesize
64KB

Download
memory/4884-348-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/4884-367-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download