Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
26-05-2022 03:55
Static task
static1
Behavioral task
behavioral1
Sample
SPIER.dfh.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SPIER.dfh.exe
Resource
win10v2004-20220414-en
General
-
Target
SPIER.dfh.exe
-
Size
971KB
-
MD5
093bd5d66d0c00dd8460371d8a7c6645
-
SHA1
1f4fea0428b350a4ae31b1b77248a74f039e3d22
-
SHA256
6e6e55b8b80a3232b0059f0aab756936505691e6b7472eb5ac7d364f7623c4e1
-
SHA512
11c33dffa91cbc51529002704ca61fc5bf524124cffd5f7325c376c5214012792520bf1d45666f58d868bdc9e4250c8fc4c9afab6eb079de50b746340cfd24fa
Malware Config
Extracted
remcos
RemoteHost
niiarmah.kozow.com:2404
-
audio_folder
MicRecords
-
audio_path
%AppData%
-
audio_record_time
5
-
connect_delay
0
-
connect_interval
1
-
copy_file
Updates.exe
-
copy_folder
Updates
-
delete_file
false
-
hide_file
false
-
hide_keylog_file
false
-
install_flag
false
-
install_path
%AppData%
-
keylog_crypt
false
-
keylog_file
logs.dat
-
keylog_flag
false
-
keylog_folder
remcos
-
keylog_path
%AppData%
-
mouse_option
false
-
mutex
Updates-NESLEV
-
screenshot_crypt
false
-
screenshot_flag
false
-
screenshot_folder
Screenshots
-
screenshot_path
%AppData%
-
screenshot_time
10
-
startup_value
Updates
-
take_screenshot_option
false
-
take_screenshot_time
5
- take_screenshot_title
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SPIER.dfh.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation SPIER.dfh.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Software\Microsoft\Windows\CurrentVersion\Run msedge.exe -
Suspicious use of SetThreadContext 9 IoCs
Processes:
SPIER.dfh.exeSPIER.dfh.exedescription pid process target process PID 3484 set thread context of 4416 3484 SPIER.dfh.exe SPIER.dfh.exe PID 4416 set thread context of 2188 4416 SPIER.dfh.exe svchost.exe PID 4416 set thread context of 3976 4416 SPIER.dfh.exe svchost.exe PID 4416 set thread context of 4612 4416 SPIER.dfh.exe svchost.exe PID 4416 set thread context of 1360 4416 SPIER.dfh.exe svchost.exe PID 4416 set thread context of 3956 4416 SPIER.dfh.exe svchost.exe PID 4416 set thread context of 4820 4416 SPIER.dfh.exe svchost.exe PID 4416 set thread context of 2624 4416 SPIER.dfh.exe svchost.exe PID 4416 set thread context of 2380 4416 SPIER.dfh.exe svchost.exe -
Drops file in Program Files directory 2 IoCs
Processes:
setup.exedescription ioc process File created C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\d263dc39-1f61-4a76-93dc-70cd606c5943.tmp setup.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20220526055616.pma setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 1 IoCs
Processes:
msedge.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
SPIER.dfh.exepowershell.exepowershell.exemsedge.exemsedge.exeidentity_helper.exepid process 3484 SPIER.dfh.exe 2292 powershell.exe 312 powershell.exe 3484 SPIER.dfh.exe 3484 SPIER.dfh.exe 3484 SPIER.dfh.exe 3484 SPIER.dfh.exe 3484 SPIER.dfh.exe 312 powershell.exe 2292 powershell.exe 4196 msedge.exe 4196 msedge.exe 2804 msedge.exe 2804 msedge.exe 2916 identity_helper.exe 2916 identity_helper.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 31 IoCs
Processes:
msedge.exepid process 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SPIER.dfh.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3484 SPIER.dfh.exe Token: SeDebugPrivilege 312 powershell.exe Token: SeDebugPrivilege 2292 powershell.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
msedge.exepid process 2804 msedge.exe 2804 msedge.exe 2804 msedge.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
SPIER.dfh.exepid process 4416 SPIER.dfh.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SPIER.dfh.exeSPIER.dfh.exesvchost.exemsedge.exedescription pid process target process PID 3484 wrote to memory of 312 3484 SPIER.dfh.exe powershell.exe PID 3484 wrote to memory of 312 3484 SPIER.dfh.exe powershell.exe PID 3484 wrote to memory of 312 3484 SPIER.dfh.exe powershell.exe PID 3484 wrote to memory of 2292 3484 SPIER.dfh.exe powershell.exe PID 3484 wrote to memory of 2292 3484 SPIER.dfh.exe powershell.exe PID 3484 wrote to memory of 2292 3484 SPIER.dfh.exe powershell.exe PID 3484 wrote to memory of 2692 3484 SPIER.dfh.exe schtasks.exe PID 3484 wrote to memory of 2692 3484 SPIER.dfh.exe schtasks.exe PID 3484 wrote to memory of 2692 3484 SPIER.dfh.exe schtasks.exe PID 3484 wrote to memory of 4612 3484 SPIER.dfh.exe SPIER.dfh.exe PID 3484 wrote to memory of 4612 3484 SPIER.dfh.exe SPIER.dfh.exe PID 3484 wrote to memory of 4612 3484 SPIER.dfh.exe SPIER.dfh.exe PID 3484 wrote to memory of 796 3484 SPIER.dfh.exe SPIER.dfh.exe PID 3484 wrote to memory of 796 3484 SPIER.dfh.exe SPIER.dfh.exe PID 3484 wrote to memory of 796 3484 SPIER.dfh.exe SPIER.dfh.exe PID 3484 wrote to memory of 4416 3484 SPIER.dfh.exe SPIER.dfh.exe PID 3484 wrote to memory of 4416 3484 SPIER.dfh.exe SPIER.dfh.exe PID 3484 wrote to memory of 4416 3484 SPIER.dfh.exe SPIER.dfh.exe PID 3484 wrote to memory of 4416 3484 SPIER.dfh.exe SPIER.dfh.exe PID 3484 wrote to memory of 4416 3484 SPIER.dfh.exe SPIER.dfh.exe PID 3484 wrote to memory of 4416 3484 SPIER.dfh.exe SPIER.dfh.exe PID 3484 wrote to memory of 4416 3484 SPIER.dfh.exe SPIER.dfh.exe PID 3484 wrote to memory of 4416 3484 SPIER.dfh.exe SPIER.dfh.exe PID 3484 wrote to memory of 4416 3484 SPIER.dfh.exe SPIER.dfh.exe PID 3484 wrote to memory of 4416 3484 SPIER.dfh.exe SPIER.dfh.exe PID 3484 wrote to memory of 4416 3484 SPIER.dfh.exe SPIER.dfh.exe PID 3484 wrote to memory of 4416 3484 SPIER.dfh.exe SPIER.dfh.exe PID 4416 wrote to memory of 2188 4416 SPIER.dfh.exe svchost.exe PID 4416 wrote to memory of 2188 4416 SPIER.dfh.exe svchost.exe PID 4416 wrote to memory of 2188 4416 SPIER.dfh.exe svchost.exe PID 4416 wrote to memory of 2188 4416 SPIER.dfh.exe svchost.exe PID 4416 wrote to memory of 2188 4416 SPIER.dfh.exe svchost.exe PID 4416 wrote to memory of 2188 4416 SPIER.dfh.exe svchost.exe PID 4416 wrote to memory of 2188 4416 SPIER.dfh.exe svchost.exe PID 4416 wrote to memory of 2188 4416 SPIER.dfh.exe svchost.exe PID 2188 wrote to memory of 2804 2188 svchost.exe msedge.exe PID 2188 wrote to memory of 2804 2188 svchost.exe msedge.exe PID 2804 wrote to memory of 1236 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1236 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe PID 2804 wrote to memory of 1256 2804 msedge.exe msedge.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SPIER.dfh.exe"C:\Users\Admin\AppData\Local\Temp\SPIER.dfh.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SPIER.dfh.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wEhmRqazZIxbJl.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wEhmRqazZIxbJl" /XML "C:\Users\Admin\AppData\Local\Temp\tmp273F.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SPIER.dfh.exe"C:\Users\Admin\AppData\Local\Temp\SPIER.dfh.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SPIER.dfh.exe"C:\Users\Admin\AppData\Local\Temp\SPIER.dfh.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SPIER.dfh.exe"C:\Users\Admin\AppData\Local\Temp\SPIER.dfh.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdcfda46f8,0x7ffdcfda4708,0x7ffdcfda47185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:25⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:35⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3044 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3100 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4932 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5492 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings5⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xdc,0xe0,0x128,0x25c,0x130,0x7ff7a7b05460,0x7ff7a7b05470,0x7ff7a7b054806⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 /prefetch:85⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5960 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6284 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1864 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6572 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7084 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7032 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7200 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7684 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7428 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7896 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7824 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5844 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7264 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4356 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8100 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7260 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8332 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8392 /prefetch:85⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,9964530462570902100,2047549626523245316,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6588 /prefetch:15⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcfda46f8,0x7ffdcfda4708,0x7ffdcfda47185⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcfda46f8,0x7ffdcfda4708,0x7ffdcfda47185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcfda46f8,0x7ffdcfda4708,0x7ffdcfda47185⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0x10c,0x7ffdcfda46f8,0x7ffdcfda4708,0x7ffdcfda47185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcfda46f8,0x7ffdcfda4708,0x7ffdcfda47185⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcfda46f8,0x7ffdcfda4708,0x7ffdcfda47185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcfda46f8,0x7ffdcfda4708,0x7ffdcfda47185⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcfda46f8,0x7ffdcfda4708,0x7ffdcfda47185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcfda46f8,0x7ffdcfda4708,0x7ffdcfda47185⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcfda46f8,0x7ffdcfda4708,0x7ffdcfda47185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcfda46f8,0x7ffdcfda4708,0x7ffdcfda47185⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcfda46f8,0x7ffdcfda4708,0x7ffdcfda47185⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=svchost.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.04⤵
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcfda46f8,0x7ffdcfda4708,0x7ffdcfda47185⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe3⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD553473ab893aa74c050da4b15a702cea9
SHA185c34c1138235afa21eae7c142640358ee110a5d
SHA2560ab2a2ba17aad5490bd5c0e2febf6087af97eff3cf347b615b1542a70909b852
SHA5123ffad5f15b37bcddd4018adfc0633e7e1573b5de829e217550d805870afdbe13194e1f0ef3026d1d26a50fc2a231966ed5eff465df4f9ea8e8490dc478df7e6d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD553473ab893aa74c050da4b15a702cea9
SHA185c34c1138235afa21eae7c142640358ee110a5d
SHA2560ab2a2ba17aad5490bd5c0e2febf6087af97eff3cf347b615b1542a70909b852
SHA5123ffad5f15b37bcddd4018adfc0633e7e1573b5de829e217550d805870afdbe13194e1f0ef3026d1d26a50fc2a231966ed5eff465df4f9ea8e8490dc478df7e6d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD553473ab893aa74c050da4b15a702cea9
SHA185c34c1138235afa21eae7c142640358ee110a5d
SHA2560ab2a2ba17aad5490bd5c0e2febf6087af97eff3cf347b615b1542a70909b852
SHA5123ffad5f15b37bcddd4018adfc0633e7e1573b5de829e217550d805870afdbe13194e1f0ef3026d1d26a50fc2a231966ed5eff465df4f9ea8e8490dc478df7e6d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD553473ab893aa74c050da4b15a702cea9
SHA185c34c1138235afa21eae7c142640358ee110a5d
SHA2560ab2a2ba17aad5490bd5c0e2febf6087af97eff3cf347b615b1542a70909b852
SHA5123ffad5f15b37bcddd4018adfc0633e7e1573b5de829e217550d805870afdbe13194e1f0ef3026d1d26a50fc2a231966ed5eff465df4f9ea8e8490dc478df7e6d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD553473ab893aa74c050da4b15a702cea9
SHA185c34c1138235afa21eae7c142640358ee110a5d
SHA2560ab2a2ba17aad5490bd5c0e2febf6087af97eff3cf347b615b1542a70909b852
SHA5123ffad5f15b37bcddd4018adfc0633e7e1573b5de829e217550d805870afdbe13194e1f0ef3026d1d26a50fc2a231966ed5eff465df4f9ea8e8490dc478df7e6d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD553473ab893aa74c050da4b15a702cea9
SHA185c34c1138235afa21eae7c142640358ee110a5d
SHA2560ab2a2ba17aad5490bd5c0e2febf6087af97eff3cf347b615b1542a70909b852
SHA5123ffad5f15b37bcddd4018adfc0633e7e1573b5de829e217550d805870afdbe13194e1f0ef3026d1d26a50fc2a231966ed5eff465df4f9ea8e8490dc478df7e6d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD553473ab893aa74c050da4b15a702cea9
SHA185c34c1138235afa21eae7c142640358ee110a5d
SHA2560ab2a2ba17aad5490bd5c0e2febf6087af97eff3cf347b615b1542a70909b852
SHA5123ffad5f15b37bcddd4018adfc0633e7e1573b5de829e217550d805870afdbe13194e1f0ef3026d1d26a50fc2a231966ed5eff465df4f9ea8e8490dc478df7e6d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD553473ab893aa74c050da4b15a702cea9
SHA185c34c1138235afa21eae7c142640358ee110a5d
SHA2560ab2a2ba17aad5490bd5c0e2febf6087af97eff3cf347b615b1542a70909b852
SHA5123ffad5f15b37bcddd4018adfc0633e7e1573b5de829e217550d805870afdbe13194e1f0ef3026d1d26a50fc2a231966ed5eff465df4f9ea8e8490dc478df7e6d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD553473ab893aa74c050da4b15a702cea9
SHA185c34c1138235afa21eae7c142640358ee110a5d
SHA2560ab2a2ba17aad5490bd5c0e2febf6087af97eff3cf347b615b1542a70909b852
SHA5123ffad5f15b37bcddd4018adfc0633e7e1573b5de829e217550d805870afdbe13194e1f0ef3026d1d26a50fc2a231966ed5eff465df4f9ea8e8490dc478df7e6d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD553473ab893aa74c050da4b15a702cea9
SHA185c34c1138235afa21eae7c142640358ee110a5d
SHA2560ab2a2ba17aad5490bd5c0e2febf6087af97eff3cf347b615b1542a70909b852
SHA5123ffad5f15b37bcddd4018adfc0633e7e1573b5de829e217550d805870afdbe13194e1f0ef3026d1d26a50fc2a231966ed5eff465df4f9ea8e8490dc478df7e6d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD553473ab893aa74c050da4b15a702cea9
SHA185c34c1138235afa21eae7c142640358ee110a5d
SHA2560ab2a2ba17aad5490bd5c0e2febf6087af97eff3cf347b615b1542a70909b852
SHA5123ffad5f15b37bcddd4018adfc0633e7e1573b5de829e217550d805870afdbe13194e1f0ef3026d1d26a50fc2a231966ed5eff465df4f9ea8e8490dc478df7e6d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD553473ab893aa74c050da4b15a702cea9
SHA185c34c1138235afa21eae7c142640358ee110a5d
SHA2560ab2a2ba17aad5490bd5c0e2febf6087af97eff3cf347b615b1542a70909b852
SHA5123ffad5f15b37bcddd4018adfc0633e7e1573b5de829e217550d805870afdbe13194e1f0ef3026d1d26a50fc2a231966ed5eff465df4f9ea8e8490dc478df7e6d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD553473ab893aa74c050da4b15a702cea9
SHA185c34c1138235afa21eae7c142640358ee110a5d
SHA2560ab2a2ba17aad5490bd5c0e2febf6087af97eff3cf347b615b1542a70909b852
SHA5123ffad5f15b37bcddd4018adfc0633e7e1573b5de829e217550d805870afdbe13194e1f0ef3026d1d26a50fc2a231966ed5eff465df4f9ea8e8490dc478df7e6d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD505567d1bf9bbcb189ea95b97da9dfea4
SHA126a14eb694a373f37dc7c77ff6007601c90ca580
SHA25684e111a24ab370ffa9ddb9d21aab90e0d9570994e20ba89f180bf8a0bf6a26ed
SHA51235885ea519dee20e9b36b9ce4878eebe3586b9a534b0b86c92b8df96e85b1afef5eb7a8f638de1ea4e3c9ef1d7acb66e22c5c6fd1362d114af0b56adac6d566e
-
C:\Users\Admin\AppData\Local\Temp\tmp273F.tmpFilesize
1KB
MD58f0f51592fe8ff5be0339d15852d2af4
SHA184d26cb7025c39b1454e7c1ed1d73fdea588f093
SHA2566d7e5cdca37c081ddca904e3103739ad2acb77c0c95313689ec2a23256fe9944
SHA51239c3796671ae36331a41ec96bd1ebe3e418f08a0e56a63adb7e97b05e1915f06e9101bcad6e0f8d8315abe4be41292161cad325c5a0bb4c097421b7ddfd13c3e
-
\??\pipe\LOCAL\crashpad_2804_NZEBHKOUZSVPWOUQMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/8-216-0x0000000000000000-mapping.dmp
-
memory/312-139-0x00000000022D0000-0x0000000002306000-memory.dmpFilesize
216KB
-
memory/312-159-0x0000000006ED0000-0x0000000006EEA000-memory.dmpFilesize
104KB
-
memory/312-164-0x00000000071F0000-0x00000000071F8000-memory.dmpFilesize
32KB
-
memory/312-151-0x0000000005BD0000-0x0000000005BEE000-memory.dmpFilesize
120KB
-
memory/312-136-0x0000000000000000-mapping.dmp
-
memory/312-154-0x0000000006170000-0x00000000061A2000-memory.dmpFilesize
200KB
-
memory/312-141-0x0000000005350000-0x0000000005372000-memory.dmpFilesize
136KB
-
memory/312-157-0x00000000061D0000-0x00000000061EE000-memory.dmpFilesize
120KB
-
memory/312-156-0x0000000071040000-0x000000007108C000-memory.dmpFilesize
304KB
-
memory/312-162-0x0000000007100000-0x000000000710E000-memory.dmpFilesize
56KB
-
memory/312-140-0x0000000004D20000-0x0000000005348000-memory.dmpFilesize
6.2MB
-
memory/392-189-0x0000000000000000-mapping.dmp
-
memory/392-221-0x0000000000000000-mapping.dmp
-
memory/432-209-0x0000000000000000-mapping.dmp
-
memory/436-223-0x0000000000000000-mapping.dmp
-
memory/444-240-0x0000000000000000-mapping.dmp
-
memory/564-192-0x0000000000000000-mapping.dmp
-
memory/736-182-0x0000000000000000-mapping.dmp
-
memory/796-145-0x0000000000000000-mapping.dmp
-
memory/960-233-0x0000000000000000-mapping.dmp
-
memory/960-190-0x0000000000000000-mapping.dmp
-
memory/1016-202-0x0000000000000000-mapping.dmp
-
memory/1120-262-0x0000000000000000-mapping.dmp
-
memory/1236-168-0x0000000000000000-mapping.dmp
-
memory/1256-170-0x0000000000000000-mapping.dmp
-
memory/1360-227-0x0000000000000000-mapping.dmp
-
memory/1408-188-0x0000000000000000-mapping.dmp
-
memory/1640-178-0x0000000000000000-mapping.dmp
-
memory/1640-200-0x0000000000000000-mapping.dmp
-
memory/1764-232-0x0000000000000000-mapping.dmp
-
memory/1884-237-0x0000000000000000-mapping.dmp
-
memory/1916-217-0x0000000000000000-mapping.dmp
-
memory/1916-264-0x0000000000000000-mapping.dmp
-
memory/1972-256-0x0000000000000000-mapping.dmp
-
memory/2188-150-0x0000000000000000-mapping.dmp
-
memory/2240-246-0x0000000000000000-mapping.dmp
-
memory/2248-257-0x0000000000000000-mapping.dmp
-
memory/2292-142-0x0000000004C80000-0x0000000004CE6000-memory.dmpFilesize
408KB
-
memory/2292-160-0x0000000007030000-0x000000000703A000-memory.dmpFilesize
40KB
-
memory/2292-161-0x0000000007240000-0x00000000072D6000-memory.dmpFilesize
600KB
-
memory/2292-155-0x0000000071040000-0x000000007108C000-memory.dmpFilesize
304KB
-
memory/2292-158-0x0000000007610000-0x0000000007C8A000-memory.dmpFilesize
6.5MB
-
memory/2292-137-0x0000000000000000-mapping.dmp
-
memory/2292-163-0x0000000007300000-0x000000000731A000-memory.dmpFilesize
104KB
-
memory/2304-173-0x0000000000000000-mapping.dmp
-
memory/2356-184-0x0000000000000000-mapping.dmp
-
memory/2592-207-0x0000000000000000-mapping.dmp
-
memory/2620-265-0x0000000000000000-mapping.dmp
-
memory/2692-138-0x0000000000000000-mapping.dmp
-
memory/2708-218-0x0000000000000000-mapping.dmp
-
memory/2708-234-0x0000000000000000-mapping.dmp
-
memory/2804-167-0x0000000000000000-mapping.dmp
-
memory/2916-191-0x0000000000000000-mapping.dmp
-
memory/2960-248-0x0000000000000000-mapping.dmp
-
memory/2996-249-0x0000000000000000-mapping.dmp
-
memory/3000-225-0x0000000000000000-mapping.dmp
-
memory/3324-255-0x0000000000000000-mapping.dmp
-
memory/3472-208-0x0000000000000000-mapping.dmp
-
memory/3484-134-0x0000000008E50000-0x0000000008EEC000-memory.dmpFilesize
624KB
-
memory/3484-130-0x0000000000840000-0x0000000000938000-memory.dmpFilesize
992KB
-
memory/3484-132-0x00000000051C0000-0x0000000005252000-memory.dmpFilesize
584KB
-
memory/3484-133-0x0000000005370000-0x000000000537A000-memory.dmpFilesize
40KB
-
memory/3484-131-0x0000000005770000-0x0000000005D14000-memory.dmpFilesize
5.6MB
-
memory/3484-135-0x0000000009520000-0x0000000009586000-memory.dmpFilesize
408KB
-
memory/3528-176-0x0000000000000000-mapping.dmp
-
memory/3628-198-0x0000000000000000-mapping.dmp
-
memory/3956-242-0x0000000000000000-mapping.dmp
-
memory/3976-195-0x0000000000000000-mapping.dmp
-
memory/3996-253-0x0000000000000000-mapping.dmp
-
memory/4100-214-0x0000000000000000-mapping.dmp
-
memory/4108-230-0x0000000000000000-mapping.dmp
-
memory/4112-201-0x0000000000000000-mapping.dmp
-
memory/4132-180-0x0000000000000000-mapping.dmp
-
memory/4140-193-0x0000000000000000-mapping.dmp
-
memory/4196-171-0x0000000000000000-mapping.dmp
-
memory/4344-205-0x0000000000000000-mapping.dmp
-
memory/4416-149-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/4416-153-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/4416-147-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/4416-146-0x0000000000000000-mapping.dmp
-
memory/4416-148-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/4504-239-0x0000000000000000-mapping.dmp
-
memory/4520-224-0x0000000000000000-mapping.dmp
-
memory/4584-186-0x0000000000000000-mapping.dmp
-
memory/4612-144-0x0000000000000000-mapping.dmp
-
memory/4612-210-0x0000000000000000-mapping.dmp
-
memory/4644-241-0x0000000000000000-mapping.dmp
-
memory/4820-258-0x0000000000000000-mapping.dmp
-
memory/4928-250-0x0000000000000000-mapping.dmp