Analysis
-
max time kernel
181s -
max time network
173s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15-05-2024 15:15
Static task
static1
URLScan task
urlscan1
General
Malware Config
Signatures
-
Detect ZGRat V1 1 IoCs
Processes:
resource yara_rule behavioral1/memory/5808-1022-0x0000000000400000-0x000000000044A000-memory.dmp family_zgrat_v1 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/5808-1022-0x0000000000400000-0x000000000044A000-memory.dmp family_redline -
Executes dropped EXE 1 IoCs
Processes:
Yuqu v_7.98.exepid process 812 Yuqu v_7.98.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Yuqu v_7.98.exedescription pid process target process PID 812 set thread context of 5808 812 Yuqu v_7.98.exe RegAsm.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
msedge.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeRegAsm.exepid process 1224 msedge.exe 1224 msedge.exe 1508 msedge.exe 1508 msedge.exe 4920 identity_helper.exe 4920 identity_helper.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 4524 msedge.exe 1916 msedge.exe 1916 msedge.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe 5808 RegAsm.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 63 IoCs
Processes:
msedge.exepid process 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
Processes:
7zG.exeRegAsm.exetaskmgr.exedescription pid process Token: SeRestorePrivilege 5540 7zG.exe Token: 35 5540 7zG.exe Token: SeSecurityPrivilege 5540 7zG.exe Token: SeSecurityPrivilege 5540 7zG.exe Token: SeDebugPrivilege 5808 RegAsm.exe Token: SeDebugPrivilege 4548 taskmgr.exe Token: SeSystemProfilePrivilege 4548 taskmgr.exe Token: SeCreateGlobalPrivilege 4548 taskmgr.exe Token: 33 4548 taskmgr.exe Token: SeIncBasePriorityPrivilege 4548 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exepid process 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe -
Suspicious use of SendNotifyMessage 56 IoCs
Processes:
msedge.exetaskmgr.exepid process 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 1508 msedge.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe 4548 taskmgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid process target process PID 1508 wrote to memory of 2620 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 2620 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 3484 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1224 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1224 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe PID 1508 wrote to memory of 1220 1508 msedge.exe msedge.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://yuqucheats.com/cheat/cs2-7062...1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa805546f8,0x7ffa80554708,0x7ffa805547182⤵PID:2620
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:22⤵PID:3484
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1224 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:82⤵PID:1220
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:12⤵PID:3528
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:12⤵PID:3708
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:82⤵PID:2396
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4920 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:12⤵PID:5048
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:12⤵PID:1520
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:12⤵PID:5092
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:12⤵PID:2536
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:12⤵PID:2964
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1308 /prefetch:12⤵PID:216
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:12⤵PID:1972
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:12⤵PID:3732
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:12⤵PID:2376
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:12⤵PID:4424
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:12⤵PID:5048
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:12⤵PID:5316
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:12⤵PID:5412
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7532 /prefetch:12⤵PID:5520
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:12⤵PID:5668
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:12⤵PID:5676
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:12⤵PID:5684
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7904 /prefetch:12⤵PID:5692
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8064 /prefetch:12⤵PID:5700
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8032 /prefetch:12⤵PID:5708
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7348 /prefetch:12⤵PID:5716
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7408 /prefetch:12⤵PID:5724
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8536 /prefetch:12⤵PID:5732
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8672 /prefetch:12⤵PID:5740
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7516 /prefetch:12⤵PID:6132
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=8660 /prefetch:82⤵PID:2248
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9328 /prefetch:12⤵PID:4900
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:12⤵PID:6440
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8988 /prefetch:12⤵PID:6664
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8408 /prefetch:12⤵PID:6816
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9696 /prefetch:12⤵PID:6832
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9776 /prefetch:12⤵PID:6992
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10436 /prefetch:12⤵PID:7004
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10604 /prefetch:12⤵PID:7012
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9000 /prefetch:12⤵PID:7084
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11004 /prefetch:12⤵PID:7156
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8568 /prefetch:12⤵PID:1656
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:12⤵PID:2944
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9088 /prefetch:12⤵PID:5712
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10408 /prefetch:12⤵PID:5368
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8204 /prefetch:12⤵PID:3388
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:12⤵PID:5344
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9772 /prefetch:12⤵PID:2180
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7596 /prefetch:12⤵PID:5384
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:12⤵PID:3012
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:12⤵PID:3520
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:12⤵PID:912
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7948 /prefetch:12⤵PID:3944
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:12⤵PID:3744
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8656 /prefetch:12⤵PID:4372
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10564 /prefetch:12⤵PID:1116
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10988 /prefetch:12⤵PID:5780
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8324 /prefetch:12⤵PID:5688
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8032 /prefetch:12⤵PID:5880
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10904 /prefetch:12⤵PID:6960
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10864 /prefetch:12⤵PID:7072
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1768 /prefetch:12⤵PID:444
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9492 /prefetch:12⤵PID:5652
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11136 /prefetch:12⤵PID:1420
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11172 /prefetch:12⤵PID:1980
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10460 /prefetch:12⤵PID:6116
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8808 /prefetch:12⤵PID:5596
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=9944 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4524 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1916
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4956
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4224
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5216
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Yuqu v_7.98\" -ad -an -ai#7zMap10000:84:7zEvent310471⤵
- Suspicious use of AdjustPrivilegeToken
PID:5540
-
C:\Users\Admin\Downloads\Yuqu v_7.98\Yuqu v_7.98.exe"C:\Users\Admin\Downloads\Yuqu v_7.98\Yuqu v_7.98.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:812 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:5752
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2936
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5808
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:4548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD54b4f91fa1b362ba5341ecb2836438dea
SHA19561f5aabed742404d455da735259a2c6781fa07
SHA256d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
SHA512fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.datFilesize
152B
MD5eaa3db555ab5bc0cb364826204aad3f0
SHA1a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA256ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
SHA512e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003bFilesize
19KB
MD5fd7b364eb1ee091ba7b6be6f443d9383
SHA15a56ee272aea7bbb2da8fbe225ad57916ae3fdcd
SHA2564d2e29c047e2ae40ad1cc38c6f28044f7c5a30fd81d743ee55fa8a254817f217
SHA512e9f29da4ad3ad5fe5a75a1b68ef88052be88ea2af6d6718963ece06e67cc9ddc6545a89c83c7178e8d9a80650fab4266e3d460ecc631a42d9bd64db600bce6f4
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003cFilesize
29KB
MD5bdcfed56131a72bd10b85bbec015d50d
SHA1f46d407d2494627617ebdb03ba5c1eaae17c1417
SHA25692c701712d4fba194b11340cc9595021b31475d4e19bae5c97d2b551ab07afea
SHA51255aa3591986b38a8f32b04660acd1b3245bfe45044dfdc980817258d8d417d37dbce13f98c1e1faf27fb27c5e7b4de26d2396bea161e06cf66a76c1b8cdb7332
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
1KB
MD594aa9f2f1e2316949b23001d7934c2b8
SHA1a43c8358c12e915218ad14bac68fcf9ec5e2ebac
SHA256a6dec921e6bf9d0a55fba5b03be0cc89e81b582222e0447f31247dd18213ac0d
SHA512da0d22b3d2eff26399bcd2e7f60bafd74eff2a6c0e10bfd43972aba1e951bdd939a6899944884c249e17bb3785dc7f1e12d444e756c1a14eb9214ce68ececa48
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-indexFilesize
2KB
MD5f09976d1b270add3e994ad8241a0808f
SHA1553207d01dc8ff1ca5d6fc00e6eb51dbaab0b67f
SHA256a11698344f8fc88e2a1b71436d09373a3e5a414ce369be195c74e29a680205af
SHA51278b43c41c4991aed18e4331234b835c87355356fbd7cdbbca5a72f3235d412fd8bea819245829d359c0766b621e36ea307c701feb60e3aca08405686b0a6b837
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
12KB
MD50d8a0698b285898f5b16c99cd19bab6f
SHA167af6f1bd50fb65b6c9e9570e65c53b3e565cdf4
SHA256adfc91d617b60908becbc32274b503b68eaadfe16350c1aee1c09d2aad2ab0f8
SHA512e3c7cc30dc3178ac7c81735d7076eb969fd1494061331265d98c0c39b1ef687cedf852e3fd8836bb1991fd6175025ab3cac13ae287a6bfe52dc10a948f567c64
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent StateFilesize
9KB
MD53f2d774104c920b75ad70201ae08a975
SHA1dfc9d2a19bd4e52ee5746bdabf3bd39f875bb01d
SHA256f2660580f3438da967f633c856cdedb6d86b1255ab058ca920f9d07fa985badb
SHA512ab9ccd40c38b3fa7472a262656af46d65c2de42284ffe83b762f8dfed7f48a2c562e11edab2ee5bb7d7695bc369767ccce61160c7a5ece26be2043be96dad57d
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD52b49ee23e93a042b780421917d35e760
SHA14242c607f39a062af65c775a68322d5b35dc63d7
SHA2564fd82a75538657510473c85509e9d394446939a0d3f4a0caf8e1d64f2a2fa25d
SHA51220752ba05f3967193e04bae1146902e49e287b9b8d7eceb148866c1cfbfd99f8241afd7663d34e4cc2de5a82968e48f9af6dee37c8c627c3d87d1ab9acdba8e6
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
10KB
MD5fd4ee0a25eda04d558a782cc51eeff93
SHA10ed6445c54983c23043bb495b05ceb8f46a4d02f
SHA2560c3a12f33e64e279a896548b24374a91f7ecefc9ac19e6ed40270a9ec0768e8e
SHA512955a57f39bd702a59fbe56acec9f2dfdfbe13d1e9dcd4876fcf0e823fdfef77e3fbc1511d3e1bca7f01a3ac836942cb21e378013c5a4fc44884b3fdb839bedef
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
14KB
MD59de58330b1efe6247d547b342c597d6f
SHA169300479a74cd654371e091e44b3c94f666cd828
SHA2566a2fbfbf3badaac3bf2a485f42623018b8f425935812fc4b800391fad0251b00
SHA512b76cc6cffc670814582eae6ac78e99a7b42af2cbdbb6b088cb097da97b96c0d14a3c56b6096b13e8bf2a07dadd4004ce50c3cb8f19195ce9fa5523ad6e1e0a40
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD57b86b2bd90e5b09e089a1682ae0cae5d
SHA189098841574c066f6cbb6b3c3094d20fce2866d4
SHA2567a4f58bd619615bee87e80631a7218f02874b2fcf2f6b88c5b06f07394e950a3
SHA512db762188b44c74f72c1664b9856356b9dbc909adc0395e84fda119dc1fde1e2c0432bf0749023711b67517c930388d891091e19c0fb252be06e5c094ea983fc3
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
13KB
MD588aebbc2a66b8ba2839d57d65b4235ae
SHA1971e35e8c090b11002ecbabb24d2bf6a151d4529
SHA2562467988f8ddcdd98b424a093ba03f58ab93e32c4c7b7d0953cd2d30329c6e050
SHA5127357af985093f57bb559ba882b1bc89f117c681647659a2303e793e2d2fdce8bed14193ef1addd29e7d74e9709a7625c134a265a743bdb745a8e45aac58caa04
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferencesFilesize
6KB
MD5d366fd4966b0adf9e4eccc9123c00cca
SHA1d09538ef30c562f084cb14950c4b897f57bc394b
SHA256f14c25bdef5be84ae8c428e69b7a3afef88a9697cdac0dcf05f7032e16c476ac
SHA5124cf9618393bc6972c476277989279f63482a48949cb12d1e51ea541f3dec377ec5bf99fcbb146a8e7e4a96c1a8e0f31d23401c0d01b12d20c33bf308bb307b75
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD5a6c908b49b1a4117650e971ebc96e951
SHA10c4579a0b4b056af5496cb86161e8e4c381bc5b6
SHA2566dfec60ebd59d38edc05e1be733b11f4ae54866725d21f02dfb40da2304b68c7
SHA512b142d882e48b2dce551f2c59dca8aed097b7460651663048a050053c2cb4d13640365cc182036271db94e57d549ab58e88972b929433a003fe152cc6798fc7d8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
4KB
MD522d2f9bc0d6112137c822ed2281c2dad
SHA14af88b888cdb664a7177ced4027b313b4e991122
SHA256040a6cda8de2accaea0d5438d98c3a711c06313b204295fa0f2153979a7a24e2
SHA5123d0b6659a6a0371cfc0f897d84345c309d081b903ff0819b8accce9f911a59c79ed1d4f45ff744aea2c5ff45a0275a456475dfeb0f8cd11c0324bab5c3a5a39b
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurityFilesize
3KB
MD5c6dd25e9a01260c5ebd53ceee626d9f4
SHA15941b9e68495f5c0515b256ae61215777adca5df
SHA2567ce1a8296a43d9b91fe2ec72fdde41b05dcdb58df0c94ec44f4574cc41986ade
SHA512aa4557238ee3a001622f34688a4bc59a9f602b35654ac896eb4bced9ada4ba111822cd0459f504551c847f2561e0c40a6a97fd8692bdad837db8a54e091fd2d8
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584b5c.TMPFilesize
2KB
MD5b7199ce5548f909c9d0bb5aef4dbde00
SHA18fc48fc3039f4b00b5c1247f293dcb6c8851b570
SHA256a640f88fc8762e12b7e0777d1afa5ad6a648603d60fbeaec0bc66378cd0e80bc
SHA512e029df3e3fcf7ac2390be06bfd2411755ecb75b5e9f4c798c22af2ca30726909a77efe1f6effd4a8175f21d3859296e1a2895ccd3c01159ae9f89e0b7a4373aa
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENTFilesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
12KB
MD59c128df06b02ba01bff0fbac79387d4a
SHA1224291453566b25eea63b86225d2824b6d73690a
SHA2560f6d411f36dae6fc289f828fed0cc4a0e90e0f994f257c0d199b08b598a0f55d
SHA512a4f3a219d709588d266665017de9f0209295d203e1c9eec6964cf0a4a778f074e24644483e4b30ebb4697a091bd3ceea64f8bba48e5c6a2cce6d9b4123f3c3fb
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local StateFilesize
11KB
MD53c1d36c953ab7a64a44fc41dad28e422
SHA19e4293d1f1d985e6b526b644c5d84688372e730f
SHA256cb17b04086959dbbac4467ac0dd6ea92a0ba5af80d195fbac9a2b4aee53bac13
SHA5123af3e67941ed90f9f69aca87af05869c9f3ce4d4ae81ef86d6184f79bd8561755cd525d9a0f430e49c102eb0c1402fa95df62c2adcacab664f82a42a1860892d
-
C:\Users\Admin\Downloads\Yuqu v_7.98\Debug\libGLESv2 - Copy (11).dllFilesize
3.7MB
MD568a2796d69106ad718a63ae471274be5
SHA157a6d4ae44412f8a0e7b0e320fb3b5d866775189
SHA2564acc00137e018585ac29cd66c52c99ba20576bc52325164b5e86a1d566f127ec
SHA51239f50ed8b619c341a849dcff97ceb9faa93b626a5972801362a28d973ff115bc6c5c5acec91e9b49169da8a015c967ec9e2215251fd52348082295aa58faccce
-
\??\pipe\LOCAL\crashpad_1508_GOZSAFDTLAMMZUXRMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/812-1023-0x0000000000890000-0x0000000000891000-memory.dmpFilesize
4KB
-
memory/812-1021-0x0000000000890000-0x0000000000891000-memory.dmpFilesize
4KB
-
memory/4548-1039-0x00000281EE740000-0x00000281EE741000-memory.dmpFilesize
4KB
-
memory/4548-1044-0x00000281EE740000-0x00000281EE741000-memory.dmpFilesize
4KB
-
memory/4548-1045-0x00000281EE740000-0x00000281EE741000-memory.dmpFilesize
4KB
-
memory/4548-1046-0x00000281EE740000-0x00000281EE741000-memory.dmpFilesize
4KB
-
memory/4548-1047-0x00000281EE740000-0x00000281EE741000-memory.dmpFilesize
4KB
-
memory/4548-1048-0x00000281EE740000-0x00000281EE741000-memory.dmpFilesize
4KB
-
memory/4548-1049-0x00000281EE740000-0x00000281EE741000-memory.dmpFilesize
4KB
-
memory/4548-1050-0x00000281EE740000-0x00000281EE741000-memory.dmpFilesize
4KB
-
memory/4548-1040-0x00000281EE740000-0x00000281EE741000-memory.dmpFilesize
4KB
-
memory/4548-1038-0x00000281EE740000-0x00000281EE741000-memory.dmpFilesize
4KB
-
memory/5808-1028-0x0000000006490000-0x000000000659A000-memory.dmpFilesize
1.0MB
-
memory/5808-1030-0x0000000006420000-0x000000000645C000-memory.dmpFilesize
240KB
-
memory/5808-1035-0x0000000008660000-0x0000000008822000-memory.dmpFilesize
1.8MB
-
memory/5808-1036-0x0000000008D60000-0x000000000928C000-memory.dmpFilesize
5.2MB
-
memory/5808-1033-0x00000000070B0000-0x0000000007126000-memory.dmpFilesize
472KB
-
memory/5808-1032-0x0000000006720000-0x0000000006786000-memory.dmpFilesize
408KB
-
memory/5808-1031-0x00000000065A0000-0x00000000065EC000-memory.dmpFilesize
304KB
-
memory/5808-1034-0x0000000007050000-0x000000000706E000-memory.dmpFilesize
120KB
-
memory/5808-1029-0x00000000063C0000-0x00000000063D2000-memory.dmpFilesize
72KB
-
memory/5808-1027-0x0000000006910000-0x0000000006F28000-memory.dmpFilesize
6.1MB
-
memory/5808-1026-0x00000000054A0000-0x00000000054AA000-memory.dmpFilesize
40KB
-
memory/5808-1025-0x0000000005300000-0x0000000005392000-memory.dmpFilesize
584KB
-
memory/5808-1024-0x00000000057B0000-0x0000000005D54000-memory.dmpFilesize
5.6MB
-
memory/5808-1022-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB