redline | hxxps://yuqucheats[.]com/cheat/cs2-7062[.][.][.]

Analysis

max time kernel
181s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 15:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://yuqucheats.com/cheat/cs2-7062...

Score

10^/10

redline zgrat discovery infostealer rat spyware stealer

Malware Config

Signatures

Detect ZGRat V1 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/5808-1022-0x0000000000400000-0x000000000044A000-memory.dmp family_zgrat_v1
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline
RedLine payload 1 IoCs

Processes:

resource yara_rule

behavioral1/memory/5808-1022-0x0000000000400000-0x000000000044A000-memory.dmp family_redline
ZGRat
ZGRat is remote access trojan written in C#.
rat zgrat
Executes dropped EXE 1 IoCs

Processes:

Yuqu v_7.98.exe

pid process

812 Yuqu v_7.98.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

Yuqu v_7.98.exe

description pid process target process

PID 812 set thread context of 5808 812 Yuqu v_7.98.exe RegAsm.exe

resource	yara_rule
behavioral1/memory/5808-1022-0x0000000000400000-0x000000000044A000-memory.dmp	family_zgrat_v1

resource	yara_rule
behavioral1/memory/5808-1022-0x0000000000400000-0x000000000044A000-memory.dmp	family_redline

pid	process
812	Yuqu v_7.98.exe

description	pid	process	target process
PID 812 set thread context of 5808	812	Yuqu v_7.98.exe	RegAsm.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeRegAsm.exe

pid	process
1224	msedge.exe
1224	msedge.exe
1508	msedge.exe
1508	msedge.exe
4920	identity_helper.exe
4920	identity_helper.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
4524	msedge.exe
1916	msedge.exe
1916	msedge.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe
5808	RegAsm.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 63 IoCs

Processes:

msedge.exe

pid	process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

7zG.exeRegAsm.exetaskmgr.exe

description	pid	process
Token: SeRestorePrivilege	5540	7zG.exe
Token: 35	5540	7zG.exe
Token: SeSecurityPrivilege	5540	7zG.exe
Token: SeSecurityPrivilege	5540	7zG.exe
Token: SeDebugPrivilege	5808	RegAsm.exe
Token: SeDebugPrivilege	4548	taskmgr.exe
Token: SeSystemProfilePrivilege	4548	taskmgr.exe
Token: SeCreateGlobalPrivilege	4548	taskmgr.exe
Token: 33	4548	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4548	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe

Suspicious use of SendNotifyMessage 56 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
1508	msedge.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe
4548	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1508 wrote to memory of 2620	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 2620	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 3484	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1224	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1224	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe
PID 1508 wrote to memory of 1220	1508	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://yuqucheats.com/cheat/cs2-7062...
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa805546f8,0x7ffa80554708,0x7ffa80554718
2⤵
PID:2620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
2⤵
PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
2⤵
PID:1220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
2⤵
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
2⤵
PID:3708

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
2⤵
PID:2396

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4920

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
2⤵
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
2⤵
PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
2⤵
PID:5092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3460 /prefetch:1
2⤵
PID:2536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
2⤵
PID:2964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1308 /prefetch:1
2⤵
PID:216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:1
2⤵
PID:1972

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
2⤵
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6332 /prefetch:1
2⤵
PID:2376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6380 /prefetch:1
2⤵
PID:4424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
2⤵
PID:5048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6920 /prefetch:1
2⤵
PID:5316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7164 /prefetch:1
2⤵
PID:5412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7532 /prefetch:1
2⤵
PID:5520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6964 /prefetch:1
2⤵
PID:5668

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
2⤵
PID:5676

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7364 /prefetch:1
2⤵
PID:5684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7904 /prefetch:1
2⤵
PID:5692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8064 /prefetch:1
2⤵
PID:5700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8032 /prefetch:1
2⤵
PID:5708

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7348 /prefetch:1
2⤵
PID:5716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7408 /prefetch:1
2⤵
PID:5724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8536 /prefetch:1
2⤵
PID:5732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8672 /prefetch:1
2⤵
PID:5740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7516 /prefetch:1
2⤵
PID:6132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=8660 /prefetch:8
2⤵
PID:2248

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9328 /prefetch:1
2⤵
PID:4900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:1
2⤵
PID:6440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8988 /prefetch:1
2⤵
PID:6664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8408 /prefetch:1
2⤵
PID:6816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9696 /prefetch:1
2⤵
PID:6832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9776 /prefetch:1
2⤵
PID:6992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10436 /prefetch:1
2⤵
PID:7004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10604 /prefetch:1
2⤵
PID:7012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9000 /prefetch:1
2⤵
PID:7084

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11004 /prefetch:1
2⤵
PID:7156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8568 /prefetch:1
2⤵
PID:1656

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
2⤵
PID:2944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9088 /prefetch:1
2⤵
PID:5712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10408 /prefetch:1
2⤵
PID:5368

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8204 /prefetch:1
2⤵
PID:3388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
2⤵
PID:5344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9772 /prefetch:1
2⤵
PID:2180

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7596 /prefetch:1
2⤵
PID:5384

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
2⤵
PID:3012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
2⤵
PID:3520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
2⤵
PID:912

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7948 /prefetch:1
2⤵
PID:3944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6844 /prefetch:1
2⤵
PID:3744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8656 /prefetch:1
2⤵
PID:4372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10564 /prefetch:1
2⤵
PID:1116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10988 /prefetch:1
2⤵
PID:5780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8324 /prefetch:1
2⤵
PID:5688

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8032 /prefetch:1
2⤵
PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10904 /prefetch:1
2⤵
PID:6960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10864 /prefetch:1
2⤵
PID:7072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1768 /prefetch:1
2⤵
PID:444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9492 /prefetch:1
2⤵
PID:5652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11136 /prefetch:1
2⤵
PID:1420

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=11172 /prefetch:1
2⤵
PID:1980

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10460 /prefetch:1
2⤵
PID:6116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8808 /prefetch:1
2⤵
PID:5596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=9944 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,10389340472846649252,11635359988964637963,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4224

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5216

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Yuqu v_7.98\" -ad -an -ai#7zMap10000:84:7zEvent31047
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5540

C:\Users\Admin\Downloads\Yuqu v_7.98\Yuqu v_7.98.exe
"C:\Users\Admin\Downloads\Yuqu v_7.98\Yuqu v_7.98.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:812

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:5752

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
PID:2936

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5808

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:4548

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b
Filesize
19KB

MD5
fd7b364eb1ee091ba7b6be6f443d9383

SHA1
5a56ee272aea7bbb2da8fbe225ad57916ae3fdcd

SHA256
4d2e29c047e2ae40ad1cc38c6f28044f7c5a30fd81d743ee55fa8a254817f217

SHA512
e9f29da4ad3ad5fe5a75a1b68ef88052be88ea2af6d6718963ece06e67cc9ddc6545a89c83c7178e8d9a80650fab4266e3d460ecc631a42d9bd64db600bce6f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c
Filesize
29KB

MD5
bdcfed56131a72bd10b85bbec015d50d

SHA1
f46d407d2494627617ebdb03ba5c1eaae17c1417

SHA256
92c701712d4fba194b11340cc9595021b31475d4e19bae5c97d2b551ab07afea

SHA512
55aa3591986b38a8f32b04660acd1b3245bfe45044dfdc980817258d8d417d37dbce13f98c1e1faf27fb27c5e7b4de26d2396bea161e06cf66a76c1b8cdb7332

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
1KB

MD5
94aa9f2f1e2316949b23001d7934c2b8

SHA1
a43c8358c12e915218ad14bac68fcf9ec5e2ebac

SHA256
a6dec921e6bf9d0a55fba5b03be0cc89e81b582222e0447f31247dd18213ac0d

SHA512
da0d22b3d2eff26399bcd2e7f60bafd74eff2a6c0e10bfd43972aba1e951bdd939a6899944884c249e17bb3785dc7f1e12d444e756c1a14eb9214ce68ececa48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
2KB

MD5
f09976d1b270add3e994ad8241a0808f

SHA1
553207d01dc8ff1ca5d6fc00e6eb51dbaab0b67f

SHA256
a11698344f8fc88e2a1b71436d09373a3e5a414ce369be195c74e29a680205af

SHA512
78b43c41c4991aed18e4331234b835c87355356fbd7cdbbca5a72f3235d412fd8bea819245829d359c0766b621e36ea307c701feb60e3aca08405686b0a6b837

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
12KB

MD5
0d8a0698b285898f5b16c99cd19bab6f

SHA1
67af6f1bd50fb65b6c9e9570e65c53b3e565cdf4

SHA256
adfc91d617b60908becbc32274b503b68eaadfe16350c1aee1c09d2aad2ab0f8

SHA512
e3c7cc30dc3178ac7c81735d7076eb969fd1494061331265d98c0c39b1ef687cedf852e3fd8836bb1991fd6175025ab3cac13ae287a6bfe52dc10a948f567c64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
9KB

MD5
3f2d774104c920b75ad70201ae08a975

SHA1
dfc9d2a19bd4e52ee5746bdabf3bd39f875bb01d

SHA256
f2660580f3438da967f633c856cdedb6d86b1255ab058ca920f9d07fa985badb

SHA512
ab9ccd40c38b3fa7472a262656af46d65c2de42284ffe83b762f8dfed7f48a2c562e11edab2ee5bb7d7695bc369767ccce61160c7a5ece26be2043be96dad57d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
2b49ee23e93a042b780421917d35e760

SHA1
4242c607f39a062af65c775a68322d5b35dc63d7

SHA256
4fd82a75538657510473c85509e9d394446939a0d3f4a0caf8e1d64f2a2fa25d

SHA512
20752ba05f3967193e04bae1146902e49e287b9b8d7eceb148866c1cfbfd99f8241afd7663d34e4cc2de5a82968e48f9af6dee37c8c627c3d87d1ab9acdba8e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
10KB

MD5
fd4ee0a25eda04d558a782cc51eeff93

SHA1
0ed6445c54983c23043bb495b05ceb8f46a4d02f

SHA256
0c3a12f33e64e279a896548b24374a91f7ecefc9ac19e6ed40270a9ec0768e8e

SHA512
955a57f39bd702a59fbe56acec9f2dfdfbe13d1e9dcd4876fcf0e823fdfef77e3fbc1511d3e1bca7f01a3ac836942cb21e378013c5a4fc44884b3fdb839bedef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
14KB

MD5
9de58330b1efe6247d547b342c597d6f

SHA1
69300479a74cd654371e091e44b3c94f666cd828

SHA256
6a2fbfbf3badaac3bf2a485f42623018b8f425935812fc4b800391fad0251b00

SHA512
b76cc6cffc670814582eae6ac78e99a7b42af2cbdbb6b088cb097da97b96c0d14a3c56b6096b13e8bf2a07dadd4004ce50c3cb8f19195ce9fa5523ad6e1e0a40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
7b86b2bd90e5b09e089a1682ae0cae5d

SHA1
89098841574c066f6cbb6b3c3094d20fce2866d4

SHA256
7a4f58bd619615bee87e80631a7218f02874b2fcf2f6b88c5b06f07394e950a3

SHA512
db762188b44c74f72c1664b9856356b9dbc909adc0395e84fda119dc1fde1e2c0432bf0749023711b67517c930388d891091e19c0fb252be06e5c094ea983fc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
13KB

MD5
88aebbc2a66b8ba2839d57d65b4235ae

SHA1
971e35e8c090b11002ecbabb24d2bf6a151d4529

SHA256
2467988f8ddcdd98b424a093ba03f58ab93e32c4c7b7d0953cd2d30329c6e050

SHA512
7357af985093f57bb559ba882b1bc89f117c681647659a2303e793e2d2fdce8bed14193ef1addd29e7d74e9709a7625c134a265a743bdb745a8e45aac58caa04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
d366fd4966b0adf9e4eccc9123c00cca

SHA1
d09538ef30c562f084cb14950c4b897f57bc394b

SHA256
f14c25bdef5be84ae8c428e69b7a3afef88a9697cdac0dcf05f7032e16c476ac

SHA512
4cf9618393bc6972c476277989279f63482a48949cb12d1e51ea541f3dec377ec5bf99fcbb146a8e7e4a96c1a8e0f31d23401c0d01b12d20c33bf308bb307b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
a6c908b49b1a4117650e971ebc96e951

SHA1
0c4579a0b4b056af5496cb86161e8e4c381bc5b6

SHA256
6dfec60ebd59d38edc05e1be733b11f4ae54866725d21f02dfb40da2304b68c7

SHA512
b142d882e48b2dce551f2c59dca8aed097b7460651663048a050053c2cb4d13640365cc182036271db94e57d549ab58e88972b929433a003fe152cc6798fc7d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
4KB

MD5
22d2f9bc0d6112137c822ed2281c2dad

SHA1
4af88b888cdb664a7177ced4027b313b4e991122

SHA256
040a6cda8de2accaea0d5438d98c3a711c06313b204295fa0f2153979a7a24e2

SHA512
3d0b6659a6a0371cfc0f897d84345c309d081b903ff0819b8accce9f911a59c79ed1d4f45ff744aea2c5ff45a0275a456475dfeb0f8cd11c0324bab5c3a5a39b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
3KB

MD5
c6dd25e9a01260c5ebd53ceee626d9f4

SHA1
5941b9e68495f5c0515b256ae61215777adca5df

SHA256
7ce1a8296a43d9b91fe2ec72fdde41b05dcdb58df0c94ec44f4574cc41986ade

SHA512
aa4557238ee3a001622f34688a4bc59a9f602b35654ac896eb4bced9ada4ba111822cd0459f504551c847f2561e0c40a6a97fd8692bdad837db8a54e091fd2d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584b5c.TMP
Filesize
2KB

MD5
b7199ce5548f909c9d0bb5aef4dbde00

SHA1
8fc48fc3039f4b00b5c1247f293dcb6c8851b570

SHA256
a640f88fc8762e12b7e0777d1afa5ad6a648603d60fbeaec0bc66378cd0e80bc

SHA512
e029df3e3fcf7ac2390be06bfd2411755ecb75b5e9f4c798c22af2ca30726909a77efe1f6effd4a8175f21d3859296e1a2895ccd3c01159ae9f89e0b7a4373aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
12KB

MD5
9c128df06b02ba01bff0fbac79387d4a

SHA1
224291453566b25eea63b86225d2824b6d73690a

SHA256
0f6d411f36dae6fc289f828fed0cc4a0e90e0f994f257c0d199b08b598a0f55d

SHA512
a4f3a219d709588d266665017de9f0209295d203e1c9eec6964cf0a4a778f074e24644483e4b30ebb4697a091bd3ceea64f8bba48e5c6a2cce6d9b4123f3c3fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
3c1d36c953ab7a64a44fc41dad28e422

SHA1
9e4293d1f1d985e6b526b644c5d84688372e730f

SHA256
cb17b04086959dbbac4467ac0dd6ea92a0ba5af80d195fbac9a2b4aee53bac13

SHA512
3af3e67941ed90f9f69aca87af05869c9f3ce4d4ae81ef86d6184f79bd8561755cd525d9a0f430e49c102eb0c1402fa95df62c2adcacab664f82a42a1860892d

Download Submit
C:\Users\Admin\Downloads\Yuqu v_7.98\Debug\libGLESv2 - Copy (11).dll
Filesize
3.7MB

MD5
68a2796d69106ad718a63ae471274be5

SHA1
57a6d4ae44412f8a0e7b0e320fb3b5d866775189

SHA256
4acc00137e018585ac29cd66c52c99ba20576bc52325164b5e86a1d566f127ec

SHA512
39f50ed8b619c341a849dcff97ceb9faa93b626a5972801362a28d973ff115bc6c5c5acec91e9b49169da8a015c967ec9e2215251fd52348082295aa58faccce

Download Submit
\??\pipe\LOCAL\crashpad_1508_GOZSAFDTLAMMZUXR
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/812-1023-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/812-1021-0x0000000000890000-0x0000000000891000-memory.dmp

Filesize
4KB

Download
memory/4548-1039-0x00000281EE740000-0x00000281EE741000-memory.dmp

Filesize
4KB

Download
memory/4548-1044-0x00000281EE740000-0x00000281EE741000-memory.dmp

Filesize
4KB

Download
memory/4548-1045-0x00000281EE740000-0x00000281EE741000-memory.dmp

Filesize
4KB

Download
memory/4548-1046-0x00000281EE740000-0x00000281EE741000-memory.dmp

Filesize
4KB

Download
memory/4548-1047-0x00000281EE740000-0x00000281EE741000-memory.dmp

Filesize
4KB

Download
memory/4548-1048-0x00000281EE740000-0x00000281EE741000-memory.dmp

Filesize
4KB

Download
memory/4548-1049-0x00000281EE740000-0x00000281EE741000-memory.dmp

Filesize
4KB

Download
memory/4548-1050-0x00000281EE740000-0x00000281EE741000-memory.dmp

Filesize
4KB

Download
memory/4548-1040-0x00000281EE740000-0x00000281EE741000-memory.dmp

Filesize
4KB

Download
memory/4548-1038-0x00000281EE740000-0x00000281EE741000-memory.dmp

Filesize
4KB

Download
memory/5808-1028-0x0000000006490000-0x000000000659A000-memory.dmp

Filesize
1.0MB

Download
memory/5808-1030-0x0000000006420000-0x000000000645C000-memory.dmp

Filesize
240KB

Download
memory/5808-1035-0x0000000008660000-0x0000000008822000-memory.dmp

Filesize
1.8MB

Download
memory/5808-1036-0x0000000008D60000-0x000000000928C000-memory.dmp

Filesize
5.2MB

Download
memory/5808-1033-0x00000000070B0000-0x0000000007126000-memory.dmp

Filesize
472KB

Download
memory/5808-1032-0x0000000006720000-0x0000000006786000-memory.dmp

Filesize
408KB

Download
memory/5808-1031-0x00000000065A0000-0x00000000065EC000-memory.dmp

Filesize
304KB

Download
memory/5808-1034-0x0000000007050000-0x000000000706E000-memory.dmp

Filesize
120KB

Download
memory/5808-1029-0x00000000063C0000-0x00000000063D2000-memory.dmp

Filesize
72KB

Download
memory/5808-1027-0x0000000006910000-0x0000000006F28000-memory.dmp

Filesize
6.1MB

Download
memory/5808-1026-0x00000000054A0000-0x00000000054AA000-memory.dmp

Filesize
40KB

Download
memory/5808-1025-0x0000000005300000-0x0000000005392000-memory.dmp

Filesize
584KB

Download
memory/5808-1024-0x00000000057B0000-0x0000000005D54000-memory.dmp

Filesize
5.6MB

Download
memory/5808-1022-0x0000000000400000-0x000000000044A000-memory.dmp

Filesize
296KB

Download