c7a53cef7508f2abb86996be29a075c2ea63bf09b1bb08e1b1b7a592cf074e60

max time kernel
296s
max time network
298s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
10/04/2024, 18:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample.html
Size

18KB
MD5

975aed651740cac29bc0fa6e3992d3cc
SHA1

42033f32c97b6be4e446c0a77690745eafc28112
SHA256

c7a53cef7508f2abb86996be29a075c2ea63bf09b1bb08e1b1b7a592cf074e60
SHA512

53a57fbf3952c5f0e08781879747d059d27a81f58c3f1a9f38c8763ba7aa8d31849e9797092c7624311b626e9aedd4937956bdefc54350ade3d480b04d1eb87d
SSDEEP

384:rTqN2DpmReVoOs41N9ylKeGM+U8HhhbG167uS2LjFrSE3+dVJCBXQL:rTqYBVoOs41ryI1M0Bhb68CFrSEMJQQL

Score

6^/10

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	ChilledWindows.exe
File opened (read-only)	\??\E:	ChilledWindows.exe
File opened (read-only)	\??\H:	ChilledWindows.exe
File opened (read-only)	\??\Q:	ChilledWindows.exe
File opened (read-only)	\??\U:	ChilledWindows.exe
File opened (read-only)	\??\V:	ChilledWindows.exe
File opened (read-only)	\??\W:	ChilledWindows.exe
File opened (read-only)	\??\B:	ChilledWindows.exe
File opened (read-only)	\??\G:	ChilledWindows.exe
File opened (read-only)	\??\T:	ChilledWindows.exe
File opened (read-only)	\??\X:	ChilledWindows.exe
File opened (read-only)	\??\A:	ChilledWindows.exe
File opened (read-only)	\??\I:	ChilledWindows.exe
File opened (read-only)	\??\K:	ChilledWindows.exe
File opened (read-only)	\??\L:	ChilledWindows.exe
File opened (read-only)	\??\P:	ChilledWindows.exe
File opened (read-only)	\??\S:	ChilledWindows.exe
File opened (read-only)	\??\J:	ChilledWindows.exe
File opened (read-only)	\??\M:	ChilledWindows.exe
File opened (read-only)	\??\N:	ChilledWindows.exe
File opened (read-only)	\??\O:	ChilledWindows.exe
File opened (read-only)	\??\R:	ChilledWindows.exe
File opened (read-only)	\??\Z:	ChilledWindows.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
2128	1236	WerFault.exe	110
5012	2104	WerFault.exe	116
3188	4248	WerFault.exe	119

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4181651180-3163410697-3990547336-1000\{F349A265-C9FD-4A47-8E6E-64A938F50A13}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4181651180-3163410697-3990547336-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4181651180-3163410697-3990547336-1000\{3EEB2D91-B49B-4FD5-8F68-7087B6D8524E}	ChilledWindows.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
2852	msedge.exe
2852	msedge.exe
3264	msedge.exe
3264	msedge.exe
4552	msedge.exe
4552	msedge.exe
1332	identity_helper.exe
1332	identity_helper.exe
908	msedge.exe
908	msedge.exe
4588	msedge.exe
4588	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe
2972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2536	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	2536	ChilledWindows.exe
Token: 33	1756	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1756	AUDIODG.EXE
Token: SeShutdownPrivilege	2536	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	2536	ChilledWindows.exe
Token: SeShutdownPrivilege	2536	ChilledWindows.exe
Token: SeCreatePagefilePrivilege	2536	ChilledWindows.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 2152	3264	msedge.exe	78
PID 3264 wrote to memory of 2152	3264	msedge.exe	78
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 240	3264	msedge.exe	79
PID 3264 wrote to memory of 2852	3264	msedge.exe	80
PID 3264 wrote to memory of 2852	3264	msedge.exe	80
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81
PID 3264 wrote to memory of 3568	3264	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa8a343cb8,0x7ffa8a343cc8,0x7ffa8a343cd8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3440 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1924,15830762479501973681,16920464051269787896,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4844

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1652

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004EC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1756

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1924

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\EXEVersion\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\EXEVersion\YouAreAnIdiot.exe"
1⤵
PID:1236
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 1452
  2⤵
  - Program crash
  PID:2128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 1236 -ip 1236
1⤵
PID:2704

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\EXEVersion\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\EXEVersion\YouAreAnIdiot.exe"
1⤵
PID:2104
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2104 -s 1424
  2⤵
  - Program crash
  PID:5012

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2104 -ip 2104
1⤵
PID:3932

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\EXEVersion\YouAreAnIdiot.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\YouAreAnIdiot\EXEVersion\YouAreAnIdiot.exe"
1⤵
PID:4248
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4248 -s 1424
  2⤵
  - Program crash
  PID:3188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4248 -ip 4248
1⤵
PID:632

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\CookieClickerHack.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\CookieClickerHack.exe"
1⤵
PID:1352

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\Avoid.exe"
1⤵
PID:4876

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ChilledWindows.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ChilledWindows.exe"
1⤵
- Enumerates connected drives
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3b1e59e67b947d63336fe9c8a1a5cebc

SHA1
5dc7146555c05d8eb1c9680b1b5c98537dd19b91

SHA256
7fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263

SHA512
2d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0e10a8550dceecf34b33a98b85d5fa0b

SHA1
357ed761cbff74e7f3f75cd15074b4f7f3bcdce0

SHA256
5694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61

SHA512
fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
0fae25fff74830cf73f675c30ad34943

SHA1
eeadf138f94f6d669b28db0f6a83efa6e3a4ba9c

SHA256
4e5c1a18169a79871ea45600885846b4ad0b3e71234a900c99446c31ec0850e4

SHA512
8d138067b5196844138928d4482082decf288b1f19a4a6251efec514c50fdc4c02b9ce4c17ac13e135ee1637466e3941ea98370e18cc862aedba6d434ad3dd42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
31e0d6aea6ad78224b240ce2c378b110

SHA1
907bc3772ff71b3c84769683dd4c35878b6632c1

SHA256
b2bf7e2dac91cfc6677165c5723255d12bd4d7aba4a173c655a48a45b23939ef

SHA512
2d0f8ceb0feac8048c1a03a43d42f1d522ac24f8b812f6e5c8572b265fa1f90c627eb43210c4b23098dca92792c6d22a479790fc55b3466a00b861f8fa02bc4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4fb258dfbbdd59c29242059b2df3638b

SHA1
84887cc5cb9740308303d64ad0cd7a1352652da3

SHA256
dfc5c3019f04ebe7c938bbd90e05078193b52c2dee4777ad0905f691745d8ab1

SHA512
b61770f4efb142cd4d60496f8a572f7ccdb907fa38e4cc6922fb1688af8d495bb711436edc06d317edcde8bcd19107f44c7dc1d3835160d5ccce1b7fa95b5eb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
026707c5d3d373b92747f83c110808de

SHA1
cac4df932a23e91805b899c78cf2173c19ea05d4

SHA256
b24acb77ec41715962d8cb5f380003d1801a6c93fb9e17281938a3f6c5c97ed1

SHA512
be6f0b8559ebdcfe601411311ec76426787de435a1c6429eeb4bb26cd73fa744978bfd89723139e6820b4a2d9a7dff9a636c705c25fd19b8ca9a5f07c4f01704

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5cbe0d0ad2a77a792ea4f01279f99667

SHA1
6538774fb21b20c10c7c45e33214734e0f275136

SHA256
11638e557a31b0ade747488eb78734a3d3bdf8cc88d01979d75f3b5164f3d9f3

SHA512
59a881bec06f092c7cf31d084fd44cc12d4e54b74e69cd09eb43a98039ba06be140301592f8f4365453fda8e94cbc75357c7e609513a216dd184fd7d4020177a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4adc01ae68610d9248df2f38aa7ca86f

SHA1
0beae40d623c23c6465ad0cdd29324b034e6c87d

SHA256
0eee718fda0217c6943280180a169c1bda5a103c5798222a71f6d0d7d751b73f

SHA512
b402a2fb1b3a90dc17f1598a8846481ba5a3c6e4de95f9ffbf01979dff4a1955d76886095290889a6ab1d99dbfdf70db54f00082a6c9adbb65c0490e0bc957d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
11524138b2866c9ab977fd38c582a5a8

SHA1
b7fc9db66744e089014f0e95e8921027c9981976

SHA256
f4863e0201107496284f28ca8fa92ceaf3e4809e82cfee6364b7b2848dc0e40b

SHA512
e62588eca63ee793c2dedd0e9ed4593669faf7d75c4013dda24d8efb175665bb9826e7db31bba4c8c5a35d5ba9221d27a2e796d3d654b096499c63f9c0262e56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
524fb1e1ec09c8b8c490e197b34d4bb6

SHA1
4d3db1c0334810ac9667f6ba32651199962acf99

SHA256
16d93cf6e45a1d82317416c280db0071194d9bf53366da80fa9fa096bc3afae4

SHA512
d3b623fc774ba239baf42f2969657be6248984efc20afc27d3958a1ac51183b8455b36984121e2c52f3f338b3cfbee50b392882d6eabd95d73aae9b8f45b5239

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1743b3f7642d8c85339526e3595ae03e

SHA1
1540ac1a0586d178343a2d05a707868ecd5ab2a1

SHA256
e1399a2fc49f0bf6f9d46e1064db1f27529c031a214f26470bb6543033eadd37

SHA512
55360d4ff3d290f4cdef7d19a5189f380f9174a9e1a27758f5f508bbaadbb779ce1fcef823252670a7bf9d1bcbdf0e99379d3ddeb76449755ee33f90b37ef412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
0e60f1761c889ea383a4bdef2048f1dc

SHA1
d53f4e5f48b30bc06b0b574cafa8d7b43b5ce8fb

SHA256
845e8853402bed3f9b5d9dc721a8d9b9e41523cdb18b2e4b9be81f822ab17d23

SHA512
ba6a63e7c215d9065c5b2ebedbab81504290053b7c3730ac08ccb8a84602c28b4fb95a803ff8c23739f67576e4be6fa41d7d8b2f05fb2fd00a09df40788509a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57efa0.TMP

Filesize
538B

MD5
64d29908524d68feb0c4b827a5c83176

SHA1
50982b498e751187e867fa77a9e46203a02e7110

SHA256
e801df12287a2e9506662d8ab4a67dd3b2a1f61fa77159a0275a6524286e7686

SHA512
6ae227c0a96f77889a37b5560fdc71e5fa3b42bf85337166f13724f79d7903637b991c1f0b2c219e66bf09fa12c15076ad96f0223e5c5b3d5670229c20467883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ac9b1959b8dabadc5e2ac94f9617bc17

SHA1
a602b0d7c3b01c5fe266176673cb99209bf31bdd

SHA256
c93d5dfbe0431312204175b5c8474c9a8057c18684da1b92fefac326c2001f17

SHA512
d23ba0584e662af829f19c1f85e01b00fe16f4fc3f4119493075c0327cdc63d650dc05afe9e16929354298eecc0f3f521366da2d7bc4fe6b84a3a4861eda4354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ff163f67c88466369b517938917ab2ea

SHA1
73d6a5a78a3bfd2e0acb71a2838e256b43165dcc

SHA256
467b3b5cc2c9b8148704f4bb0434dc8607b09b05cdebeec7173e657f4d2483b2

SHA512
b4586bdd71b6c87120d2439a4928e321956858b4342a3431bba25baae394f78d3333c6f09067a924861de32cc05ee01eb4a000157a667f56a0294dadb3bc0086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

Filesize
896KB

MD5
73e057eb5a364df04230f8af3113655c

SHA1
f7fa7762d4c8c0a383c501eae6212f0511f1e6d5

SHA256
cd2f6bb7a51753e81481fc169d07141bcabb1735479bfcbb7ffb7fdea804ff15

SHA512
1256cc106caac887a9c82d66386a4f0629c19cde63d17fa962431b7d6720d7d1b438099cb5bbda5677e4723e850b524b9c90d9a170d1a4b11979690d602cfd28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML

Filesize
9KB

MD5
7050d5ae8acfbe560fa11073fef8185d

SHA1
5bc38e77ff06785fe0aec5a345c4ccd15752560e

SHA256
cb87767c4a384c24e4a0f88455f59101b1ae7b4fb8de8a5adb4136c5f7ee545b

SHA512
a7a295ac8921bb3dde58d4bcde9372ed59def61d4b7699057274960fa8c1d1a1daff834a93f7a0698e9e5c16db43af05e9fd2d6d7c9232f7d26ffcff5fc5900b

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier

Filesize
26B

MD5
fbccf14d504b7b2dbcb5a5bda75bd93b

SHA1
d59fc84cdd5217c6cf74785703655f78da6b582b

SHA256
eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913

SHA512
aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98

Download Submit
C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\chilledwindows.mp4

Filesize
3.6MB

MD5
698ddcaec1edcf1245807627884edf9c

SHA1
c7fcbeaa2aadffaf807c096c51fb14c47003ac20

SHA256
cde975f975d21edb2e5faa505205ab8a2c5a565ba1ff8585d1f0e372b2a1d78b

SHA512
a2c326f0c653edcd613a3cefc8d82006e843e69afc787c870aa1b9686a20d79e5ab4e9e60b04d1970f07d88318588c1305117810e73ac620afd1fb6511394155

Download Submit
memory/1236-465-0x0000000000CD0000-0x0000000000D42000-memory.dmp

Filesize
456KB

Download
memory/1236-472-0x00000000059F0000-0x0000000005A46000-memory.dmp

Filesize
344KB

Download
memory/1236-473-0x00000000059E0000-0x00000000059EA000-memory.dmp

Filesize
40KB

Download
memory/1236-474-0x0000000074E90000-0x0000000075641000-memory.dmp

Filesize
7.7MB

Download
memory/1236-470-0x0000000005AC0000-0x0000000005AD0000-memory.dmp

Filesize
64KB

Download
memory/1236-471-0x00000000057E0000-0x00000000057EA000-memory.dmp

Filesize
40KB

Download
memory/1236-469-0x00000000058F0000-0x0000000005982000-memory.dmp

Filesize
584KB

Download
memory/1236-468-0x0000000005EA0000-0x0000000006446000-memory.dmp

Filesize
5.6MB

Download
memory/1236-466-0x0000000005800000-0x000000000589C000-memory.dmp

Filesize
624KB

Download
memory/1236-467-0x0000000074E90000-0x0000000075641000-memory.dmp

Filesize
7.7MB

Download
memory/1352-502-0x0000000001180000-0x0000000001190000-memory.dmp

Filesize
64KB

Download
memory/1352-500-0x0000000001180000-0x0000000001190000-memory.dmp

Filesize
64KB

Download
memory/1352-490-0x000000001B9C0000-0x000000001BA66000-memory.dmp

Filesize
664KB

Download
memory/1352-492-0x0000000001180000-0x0000000001190000-memory.dmp

Filesize
64KB

Download
memory/1352-493-0x000000001BF40000-0x000000001C40E000-memory.dmp

Filesize
4.8MB

Download
memory/1352-494-0x00007FFA75BC0000-0x00007FFA76561000-memory.dmp

Filesize
9.6MB

Download
memory/1352-495-0x000000001C4E0000-0x000000001C57C000-memory.dmp

Filesize
624KB

Download
memory/1352-496-0x00000000013A0000-0x00000000013A8000-memory.dmp

Filesize
32KB

Download
memory/1352-497-0x000000001C740000-0x000000001C78C000-memory.dmp

Filesize
304KB

Download
memory/1352-498-0x0000000001180000-0x0000000001190000-memory.dmp

Filesize
64KB

Download
memory/1352-499-0x00007FFA75BC0000-0x00007FFA76561000-memory.dmp

Filesize
9.6MB

Download
memory/1352-491-0x00007FFA75BC0000-0x00007FFA76561000-memory.dmp

Filesize
9.6MB

Download
memory/1352-501-0x00007FFA75BC0000-0x00007FFA76561000-memory.dmp

Filesize
9.6MB

Download
memory/2104-475-0x0000000074F30000-0x00000000756E1000-memory.dmp

Filesize
7.7MB

Download
memory/2104-476-0x0000000005250000-0x0000000005260000-memory.dmp

Filesize
64KB

Download
memory/2104-477-0x0000000074F30000-0x00000000756E1000-memory.dmp

Filesize
7.7MB

Download
memory/2536-521-0x000000001C130000-0x000000001C168000-memory.dmp

Filesize
224KB

Download
memory/2536-505-0x0000000000120000-0x0000000000584000-memory.dmp

Filesize
4.4MB

Download
memory/2536-506-0x00007FFA72640000-0x00007FFA73102000-memory.dmp

Filesize
10.8MB

Download
memory/2536-507-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

Filesize
64KB

Download
memory/2536-519-0x000000001BA30000-0x000000001BA38000-memory.dmp

Filesize
32KB

Download
memory/2536-520-0x0000000000ED0000-0x0000000000EE0000-memory.dmp

Filesize
64KB

Download
memory/2536-522-0x000000001C0F0000-0x000000001C0FE000-memory.dmp

Filesize
56KB

Download
memory/4248-489-0x0000000074F30000-0x00000000756E1000-memory.dmp

Filesize
7.7MB

Download
memory/4248-487-0x0000000074F30000-0x00000000756E1000-memory.dmp

Filesize
7.7MB

Download
memory/4248-488-0x0000000005CB0000-0x0000000005CC0000-memory.dmp

Filesize
64KB

Download
memory/4876-504-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/4876-503-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download