Analysis

  • max time kernel
    200s
  • max time network
    227s
  • platform
    windows10-ltsc 2021_x64
  • resource
    win10ltsc2021-20241023-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
  • submitted
    05-11-2024 18:41

General

  • Target

    kreo q zi.7z

  • Size

    922KB

  • MD5

    ec516db688f94e98d5141f4bade557e9

  • SHA1

    198ffbae5eed415ac673f5e371774759f1a53de1

  • SHA256

    282d6f5ddc83351dab51e6decc1293b078638f0cfd0baca4673afc8246fd32bd

  • SHA512

    ecc34ad7d15fbedbbc4e62b469f5e6e5e71099e19831574da61dc9f751ed5b2faad1676b8b3dbf0911c4dac628c7a15e9d07d953692c5ab1b700ea07f6396985

  • SSDEEP

    24576:yScP7qLl4iGQATiKL0aywxTodSrUF+nVZLLymvgDoSAWcNtMXqWOU:07qLl4KATiJUo0UEnLmmvqiWcNtMXDOU

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Office04

C2

hola435-24858.portmap.host:24858

Mutex

e51e2b65-e963-4051-9736-67d57ed46798

Attributes
  • encryption_key

    AEA258EF65BF1786F0F767C0BE2497ECC304C46F

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Quasar Client Startup

  • subdirectory

    SubDir

Signatures

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 2 IoCs
  • A potential corporate email address has been identified in the URL: =@L
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 7 IoCs
  • Opens file in notepad (likely ransom note) 6 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\kreo q zi.7z"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:4104
  • C:\Users\Admin\Desktop\kreo q zi.exe
    "C:\Users\Admin\Desktop\kreo q zi.exe"
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4928
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
      2⤵
      • Scheduled Task/Job: Scheduled Task
      PID:1584
    • C:\Users\Admin\AppData\Roaming\SubDir\Client.exe
      "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2460
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "Quasar Client Startup" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Client.exe" /rl HIGHEST /f
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4508
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\ntuser.ini
        3⤵
        • Opens file in notepad (likely ransom note)
        PID:3940
      • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\AppData\Roaming\BackupSave.ppt" /ou ""
        3⤵
          PID:7660
        • C:\Windows\system32\msinfo32.exe
          "C:\Windows\system32\msinfo32.exe" "C:\Users\Admin\AppData\Roaming\DisconnectUse.nfo"
          3⤵
            PID:8128
          • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
            "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Roaming\FormatUnregister.ods"
            3⤵
              PID:8180
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\GetDisconnect.pdf
              3⤵
                PID:7288
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x128,0x12c,0xc8,0x130,0x7ffbca0446f8,0x7ffbca044708,0x7ffbca044718
                  4⤵
                    PID:5660
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,6923643741534377711,15718219320605485012,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
                    4⤵
                      PID:7092
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,6923643741534377711,15718219320605485012,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
                      4⤵
                        PID:7096
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,6923643741534377711,15718219320605485012,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
                        4⤵
                          PID:7156
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6923643741534377711,15718219320605485012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
                          4⤵
                            PID:2072
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6923643741534377711,15718219320605485012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
                            4⤵
                              PID:7780
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6923643741534377711,15718219320605485012,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4372 /prefetch:1
                              4⤵
                                PID:8664
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2240,6923643741534377711,15718219320605485012,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=5200 /prefetch:6
                                4⤵
                                  PID:8880
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6923643741534377711,15718219320605485012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
                                  4⤵
                                    PID:8344
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6923643741534377711,15718219320605485012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
                                    4⤵
                                      PID:8468
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6923643741534377711,15718219320605485012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
                                      4⤵
                                        PID:7728
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6923643741534377711,15718219320605485012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
                                        4⤵
                                          PID:8352
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6923643741534377711,15718219320605485012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
                                          4⤵
                                            PID:9656
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6923643741534377711,15718219320605485012,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
                                            4⤵
                                              PID:9236
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,6923643741534377711,15718219320605485012,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6436 /prefetch:1
                                              4⤵
                                                PID:8336
                                            • C:\Windows\System32\WScript.exe
                                              "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\GetOpen.vbs"
                                              3⤵
                                                PID:5668
                                              • C:\Windows\system32\NOTEPAD.EXE
                                                "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\HideDeny.ps1xml
                                                3⤵
                                                • Opens file in notepad (likely ransom note)
                                                PID:7380
                                              • C:\Windows\system32\mspaint.exe
                                                "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Roaming\ImportComplete.rle"
                                                3⤵
                                                  PID:6604
                                                • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Roaming\ImportNew.m1v"
                                                  3⤵
                                                    PID:7696
                                                  • C:\Windows\System32\notepad.exe
                                                    "C:\Windows\System32\notepad.exe" "C:\Users\Admin\AppData\Roaming\InstallGet.ps1"
                                                    3⤵
                                                    • Opens file in notepad (likely ransom note)
                                                    PID:7720
                                                  • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Roaming\LockConvertFrom.au"
                                                    3⤵
                                                      PID:8004
                                                    • C:\Windows\System32\WScript.exe
                                                      "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\NewConvertTo.vbs"
                                                      3⤵
                                                        PID:9032
                                                      • C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
                                                        "C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" /n "C:\Users\Admin\AppData\Roaming\PushUnblock.potm"
                                                        3⤵
                                                          PID:9136
                                                        • C:\Windows\system32\NOTEPAD.EXE
                                                          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\RemoveInvoke.ini
                                                          3⤵
                                                          • Opens file in notepad (likely ransom note)
                                                          PID:9180
                                                        • C:\Windows\System32\notepad.exe
                                                          "C:\Windows\System32\notepad.exe" "C:\Users\Admin\AppData\Roaming\ResolveDisconnect.ps1"
                                                          3⤵
                                                          • Opens file in notepad (likely ransom note)
                                                          PID:4064
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\ResolvePop.html
                                                          3⤵
                                                            PID:400
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbca0446f8,0x7ffbca044708,0x7ffbca044718
                                                              4⤵
                                                                PID:8232
                                                            • C:\Windows\system32\NOTEPAD.EXE
                                                              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\RestartTrace.css
                                                              3⤵
                                                              • Opens file in notepad (likely ransom note)
                                                              PID:8292
                                                            • C:\Windows\system32\mspaint.exe
                                                              "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Roaming\RevokeSelect.jpe"
                                                              3⤵
                                                                PID:8572
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\RevokeSync.shtml
                                                                3⤵
                                                                  PID:8804
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x12c,0x130,0x134,0x108,0x138,0x7ffbca0446f8,0x7ffbca044708,0x7ffbca044718
                                                                    4⤵
                                                                      PID:8728
                                                                  • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Roaming\RevokeUnregister.aiff"
                                                                    3⤵
                                                                      PID:4752
                                                                    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
                                                                      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n /f "C:\Users\Admin\AppData\Roaming\SearchSave.dotm"
                                                                      3⤵
                                                                        PID:9132
                                                                      • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
                                                                        "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Roaming\SplitMeasure.doc" /o ""
                                                                        3⤵
                                                                          PID:9364
                                                                        • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                          "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Roaming\TestWait.WTV"
                                                                          3⤵
                                                                            PID:9408
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Roaming\TraceDebug.mhtml
                                                                            3⤵
                                                                              PID:9472
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ffbca0446f8,0x7ffbca044708,0x7ffbca044718
                                                                                4⤵
                                                                                  PID:9512
                                                                              • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Roaming\UndoBlock.ram"
                                                                                3⤵
                                                                                  PID:9600
                                                                                • C:\Program Files\Internet Explorer\iexplore.exe
                                                                                  "C:\Program Files\Internet Explorer\iexplore.exe" -nohome
                                                                                  3⤵
                                                                                    PID:9544
                                                                                    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                                                                                      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:9544 CREDAT:17410 /prefetch:2
                                                                                      4⤵
                                                                                        PID:9856
                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                  1⤵
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:4648
                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                  1⤵
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:1832
                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                  1⤵
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:4852
                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                  1⤵
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:2340
                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                  1⤵
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:1404
                                                                                • C:\Windows\system32\OpenWith.exe
                                                                                  C:\Windows\system32\OpenWith.exe -Embedding
                                                                                  1⤵
                                                                                  • Modifies registry class
                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                  PID:3384
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                                                                  1⤵
                                                                                  • Drops file in Windows directory
                                                                                  • Enumerates system info in registry
                                                                                  • Modifies data under HKEY_USERS
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  • Suspicious use of FindShellTrayWindow
                                                                                  • Suspicious use of SendNotifyMessage
                                                                                  • Suspicious use of WriteProcessMemory
                                                                                  PID:728
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x224,0x228,0x22c,0x220,0x230,0x7ffbe750cc40,0x7ffbe750cc4c,0x7ffbe750cc58
                                                                                    2⤵
                                                                                      PID:4180
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=1908 /prefetch:2
                                                                                      2⤵
                                                                                        PID:1584
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2072,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2020 /prefetch:3
                                                                                        2⤵
                                                                                          PID:4920
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2468 /prefetch:8
                                                                                          2⤵
                                                                                            PID:1700
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3176,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3188 /prefetch:1
                                                                                            2⤵
                                                                                              PID:1868
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3208,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3228 /prefetch:1
                                                                                              2⤵
                                                                                                PID:4824
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3748,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4608 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:2108
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4744,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4752 /prefetch:8
                                                                                                  2⤵
                                                                                                    PID:736
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4724,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4864 /prefetch:8
                                                                                                    2⤵
                                                                                                      PID:2648
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4976,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4952 /prefetch:8
                                                                                                      2⤵
                                                                                                        PID:2580
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5072,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5068 /prefetch:8
                                                                                                        2⤵
                                                                                                          PID:3396
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4836,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5084 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:4724
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4540,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5220 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:2332
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=3228,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3220 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:2152
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=5344,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5336 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:4532
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4464,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3536 /prefetch:8
                                                                                                                  2⤵
                                                                                                                    PID:4364
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5512,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5524 /prefetch:8
                                                                                                                    2⤵
                                                                                                                      PID:3232
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=4740,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4620 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:1964
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=5712,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5208 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:2324
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=3264,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5728 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:3664
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5480,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=4428 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:2644
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --field-trial-handle=5600,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5232 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:188
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5556,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=3576 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:2364
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --field-trial-handle=5516,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5780 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:3004
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5768,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6016 /prefetch:1
                                                                                                                                    2⤵
                                                                                                                                      PID:1236
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --field-trial-handle=6040,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6108 /prefetch:1
                                                                                                                                      2⤵
                                                                                                                                        PID:1876
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --field-trial-handle=6104,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=5108 /prefetch:1
                                                                                                                                        2⤵
                                                                                                                                          PID:4424
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --field-trial-handle=6256,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6276 /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                            PID:2712
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --field-trial-handle=6424,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6456 /prefetch:1
                                                                                                                                            2⤵
                                                                                                                                              PID:748
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --field-trial-handle=6440,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6444 /prefetch:1
                                                                                                                                              2⤵
                                                                                                                                                PID:3712
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --field-trial-handle=6744,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6728 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                  PID:2072
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --field-trial-handle=6892,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6868 /prefetch:1
                                                                                                                                                  2⤵
                                                                                                                                                    PID:1640
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --field-trial-handle=6920,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7012 /prefetch:1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:4648
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --field-trial-handle=7036,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7144 /prefetch:1
                                                                                                                                                      2⤵
                                                                                                                                                        PID:3696
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --field-trial-handle=7152,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7272 /prefetch:1
                                                                                                                                                        2⤵
                                                                                                                                                          PID:4556
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --field-trial-handle=7536,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7528 /prefetch:1
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5184
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --field-trial-handle=7472,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7640 /prefetch:1
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5196
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --field-trial-handle=7860,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=8060 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                                PID:5568
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --field-trial-handle=8276,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=8032 /prefetch:1
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:5576
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --field-trial-handle=7984,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=8008 /prefetch:1
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:5584
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --field-trial-handle=8356,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=8348 /prefetch:1
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:5592
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --field-trial-handle=6640,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6560 /prefetch:1
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:6036
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --field-trial-handle=7316,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7792 /prefetch:1
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:6048
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --field-trial-handle=6596,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6316 /prefetch:1
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:6056
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --field-trial-handle=6392,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6612 /prefetch:1
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:5424
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --field-trial-handle=7128,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7068 /prefetch:1
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:5420
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --field-trial-handle=8620,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=8780 /prefetch:1
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:5548
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --field-trial-handle=7388,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7400 /prefetch:1
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:2712
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --field-trial-handle=7376,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7420 /prefetch:1
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:5988
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --field-trial-handle=9320,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=9336 /prefetch:1
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:5964
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --field-trial-handle=6696,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7512 /prefetch:1
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:5284
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --field-trial-handle=6792,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=6724 /prefetch:1
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:5292
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --field-trial-handle=9528,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=9492 /prefetch:1
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:5908
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --field-trial-handle=9576,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=9560 /prefetch:1
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:6120
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --field-trial-handle=9608,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=9584 /prefetch:1
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:5400
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --field-trial-handle=9768,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=9628 /prefetch:1
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:3684
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --field-trial-handle=9516,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=9772 /prefetch:1
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:3500
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --field-trial-handle=9896,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=9868 /prefetch:1
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:6116
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --field-trial-handle=9296,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=10008 /prefetch:1
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:6164
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --field-trial-handle=10156,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=10164 /prefetch:1
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:6272
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --field-trial-handle=10172,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=10272 /prefetch:1
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:6280
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --field-trial-handle=10140,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=10280 /prefetch:1
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:6384
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --field-trial-handle=10676,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=10604 /prefetch:1
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:6392
                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --field-trial-handle=10784,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=10912 /prefetch:1
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:6524
                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --field-trial-handle=10968,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=10776 /prefetch:1
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:6532
                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --field-trial-handle=10464,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=10792 /prefetch:1
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:6636
                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --field-trial-handle=11052,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=11032 /prefetch:1
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:6644
                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --field-trial-handle=11320,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=9144 /prefetch:1
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:6872
                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --field-trial-handle=7028,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=10904 /prefetch:1
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:6880
                                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --field-trial-handle=6668,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=7296 /prefetch:1
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:6888
                                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --field-trial-handle=10828,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=9652 /prefetch:1
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:6992
                                                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --field-trial-handle=9588,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=11376 /prefetch:1
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:7000
                                                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --field-trial-handle=11352,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=11388 /prefetch:1
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:7008
                                                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --field-trial-handle=11428,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=11412 /prefetch:1
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:7016
                                                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --field-trial-handle=11728,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=11732 /prefetch:1
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:228
                                                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --field-trial-handle=9592,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=11848 /prefetch:1
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:6048
                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=11452,i,15130285273893863514,13742414443563028577,262144 --variations-seed-version=20241022-180310.361000 --mojo-platform-channel-handle=2420 /prefetch:8
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:9836
                                                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                              PID:4688
                                                                                                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                PID:232
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Windows Media Player\wmplayer.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                • Enumerates connected drives
                                                                                                                                                                                                                                                • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                • Suspicious use of FindShellTrayWindow
                                                                                                                                                                                                                                                PID:5180
                                                                                                                                                                                                                                                • C:\Windows\SysWOW64\unregmp2.exe
                                                                                                                                                                                                                                                  "C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                  • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                                                  PID:6804
                                                                                                                                                                                                                                                  • C:\Windows\system32\unregmp2.exe
                                                                                                                                                                                                                                                    "C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Enumerates connected drives
                                                                                                                                                                                                                                                    PID:2520
                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                                                PID:7328
                                                                                                                                                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                                                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:7608
                                                                                                                                                                                                                                                • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:8460
                                                                                                                                                                                                                                                  • C:\Windows\system32\OpenWith.exe
                                                                                                                                                                                                                                                    C:\Windows\system32\OpenWith.exe -Embedding
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:8552
                                                                                                                                                                                                                                                    • C:\Windows\System32\CompPkgSrv.exe
                                                                                                                                                                                                                                                      C:\Windows\System32\CompPkgSrv.exe -Embedding
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:8688

                                                                                                                                                                                                                                                      Network

                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        649B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        ae84689f755bb85b368b2031e0256e61

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        f6dcb8189cda757175a4d9008e265c17e53ae07c

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        d244c67ce9e640a8851d9a52cbd98564baf19b369a21e5e049e844afccb7bc07

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        8f10c54b89465b63794239c7edae5753e422a285e80cf4fd8af80e98d28829584862d335e5395f293f81350a54ed335d2caca1e35cf2dedf9d5659a455825add

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        33259b9f223f95db15542647b99d229d

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        ecb159ab40858b8e8e752d55bbcbe1902fbab1cb

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        454765c88f2eb48c1c8ba69193e845a309a006e7766191505943ee636abc32fc

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        84dd2d56861f1f6e0377e05e12b1937be8eba4898d12d63f17ab6d17df21d29530c38669eb7561e47073a907626e778c3e317740a511ddbeb48466660f871e58

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        eeea0fd3ae7274ff7a84a859d9397696

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        d31a90b46933b948773c894f783c3f5284f73a11

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        a2f687bda04f98e9d039ec58fe98801698fa02450624ce73abc4387d77f29db7

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        56ca6ec4494f9055bf96f6fcac0a551a82f93ecf643c53dfadcc00322d6555d15c37d748e6413c86e12035c7c635771d299e902af2cf65ed7b987e42ecf91a53

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        7KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        3b11798616e036ab9c9b3978a687aef5

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        c5035c4969fb685a535622f1a0a45ed101b64ebf

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        bbbe177a86c5b34bc41c7cb3989c19102db449ed070fbe5d426aa71ca555a0d4

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        61a033dc82e625c4859c13680e2e538fc84340768124ea79dc1d2bd810e773d6383278bf329dfc193f30f4c5f8a2427855011cbeec19c62a6c652a6381caee5d

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        2B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        d751713988987e9331980363e24189ce

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        97d170e1550eee4afc0af065b78cda302a97674c

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        857B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        1cbabbf9e054ef34fce9f5be9b080356

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        c6a8cff9e9fc8214557e33d1e3cfac0efe962c33

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        6e19c152d43fa53efe02b2e02d1208e7eaaa5bb1944461e957087dc78d76560a

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        444c9d0ac0f453fd3d6bfb0ad025413df1ed161d2966741ebc91e5edd7341220505bd19a99b59036b4de6bd84099fb5500b02ab9b5290f6fb2225c727aaf467d

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1024B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        f180f8d4ca609f8ae8fb83a9967f8020

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        278c4ad7fb688a35ba8fdfc6a48e3216a72bf09c

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        e8c050a55f4945e2e5d4faf78438ee499841d1c2382e28f8b0df0e736a35fec3

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        34bc32706bdd2813d39b7bf2aa548456d5182421d63cdc99f9eb1900d154eeefb10fa4392321ec5e51ab4aa2c2749acaa8ff661f50e23a5952c64d0655852cd9

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        354B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        19395343998566dad3ff93c5f7446856

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        802b8b76e5c3a9b07a9ba7b7261fd68304ddd7eb

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        7454c10f1a8a52ec9e884e43ed6e4a2ceadb7294fd626f4bebd4150a0fb8b307

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        3c942b908e7661763ec7e0cea521ede6881212399caf24e824c71a7719e5c0bcf63bf7b9e6ce8ee1d48907e54f3873f140c27a3677372060f36838202eb86b13

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        2KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        c326043c5f761f1c20e5cd097a9ef255

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        e7d9f5d3182bd7ddc93775580a547217f88a0fa7

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        e15b628b467f3a199bbeef57bc2020642e069b77d9ef6302f1300c6c09556986

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        ab9f279facd3171d1a91e9db4778bb730e0e4a000b9baa6d0e7f1c9b640412ef2fc807035a3d753a98aa3e0bf4dd5f1771d0797b4e846ccff35492e421d4f197

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        d51ba0e31a882a65600bf9936d7b2999

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        e1f0beac233d32a3188dedcce6c2eed53539d9ab

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        b9600239579bc1ac6dd287cdca4179c2a79bc403c52c32ad438a2a9ede4d253b

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        b37cafe0bb66329b6d64d8f74034a34adf053e4b9466556a362d0e80ad4cb59c8742bc5a67db8d9ed7e9a6b7706a256f05631bf845d7c2dfc084f13872dc4c4e

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        857B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        12f676a25b7f052ebce23b40113b4769

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        48415a1d89348309a8b22797e01bf0e715f973d4

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        51de28bb12cfed341a0f1450530ab30887755987ebff902d65198a4861ceec9d

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        e14ff9e0034fb7e17618464320114223532ebc25f781a9dee072d630af14220f93e18edfb77b5e3ac1083940c60527a799e531dc3b7ef5c2fed3857d2a356a45

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        354B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        c041dd45b89754cb4fec18404d023253

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        46bbf41563da95d24881b426ec65e33111756d07

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        4e95270ef49b5e8618092d9d0bb34243ff8b5f8d0e49fc27be3a54514198128e

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        ba7b3af777e68fb4d622cb5dc8d923dd07f6e562402ad370c74f5793f7ca9adf3bf218aceb9666873bd69ef0814831f299274c3fe3d60f3d234a5610e0e8b373

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        6KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        751c25b35f61a155e21002dcc7c5ffee

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        692a6b18c80e0219942714c7f3356709ed541c9c

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        80bfc37549140ad990e11079dcff5126f1e04b4b17e6d564e3af6d2013732df9

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        c0ed12cbd287f161d0425e9ce83f17417bb98b9943e035dfe7558dbbdd02d68f65039d1cd69ec507cf85542b823a6de2a927f73a6ccaf475b53fb33b7c6accd2

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        10KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        36fe7b08e62400711cdce040f8cca964

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        6f7d5d4c49424a5766a88a87b960d1de915ca034

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        2b388399837f1d04f8700517bf4a7014f22dbfa28d4229ff315f3cf9e2443af1

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        82972a67f5fefe858064448a45732a570a1bb37701e7a8ef4d52184fddb6b8df8bf56ef403adab9347ea01093d4ddb8146551c891928c0196cd372877930201e

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        9KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        2183e273e13e467d496a31f160b24c63

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        90673e7cec4af364281a7ed24928b813d47eb816

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        6cffbf24072f84f80e118787829c47be8d94ac3b3a9e4d657c5e1ffbac50d658

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        00ada504d6a3dc06b4b7ebb0e4792f49b8a6f4dfaa25b8d3069ab402b5167008243ca93f18f92389cfe6474f30b4d393af746a71e520fe5da0a1cb6c627b0114

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        e2311d4c310082329d5033fa5452a1e5

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        c199660e08abae1104dbf3b786afc5f45bc5eae7

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        fc042907e5d82c21ea8f96c58657fdba4fd7d9ef123ad1c973ea6ac3d34febf5

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        2bd211b4c448dc73cb1a279791a59955e2ba817ad4a2f3460f78fc8c3d268bc4733193f40c8b6090fc745948f9e118b0baa8ab41f27f361830da881f320f5113

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        9KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        29adcd297f84600c68e5239562c3b9c5

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        bd0505b864df3ef6a08e5b210f97e47a7aca8739

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        0fc06b6d34d84874d89cdc408b91876260b1d698643875726c7e5d77b7669c72

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        c48baf0b8c5985c00eb38d237beb9bd7825bb550cf2dcd00531bc78d8c87db7448e56e14249d13bf48142902c82eec48578738c00cee322d137178a71f12bd8f

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        10KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        45ba2e345a50d1a76ce626186ad609cf

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        98b2f9bfba82b75c81b48da05ff87d5f16b4d428

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        71e167ef12cd788a4a4c22233eaeaa596a9e25aa9e1c3426b392064f3ae11095

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        a5d0666a7db0c9d2c5a1629c66003e40a8beba73b6f4fb9015eca4af647781bb931e7dc4bc8b5bb6c5cb5f6c1e099b30cc18c2837a41e728e7db7706407e64c2

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        10KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        9169dea013d5aa6e3709a054dc724f33

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        63802fdffbe0075899b4a4aff7251179e0c4433b

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        19aac464681de58c083a1855863f8d491e70c547bc6d9e436df5f1b9e2506174

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        6c74e61a52a818ceb0546e5a9bf53f9d24e0107fbb78d9abb9f406a99982e7f614a48b01382df959650c41155aa33df49b330609c49f8b172e46b2a51f12baf5

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        10KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        0423807e29f4731c4dcf4cb05fa4883e

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        482b0cd737eba6ef272851a15f8dc34108435471

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        33dff61d7ca9445062c0db18a392b8f4315b497b35178f10d51295a622e05d34

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        b3f022bb63efdb8742833cb88d0c995e9ca71eec52dd58a97ecb24641d387608a216da56348f5ec4fdec109385a0bab436d89ac8b78eef13e536ef68066108d1

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        10KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        f90790a153730294f5b21ca8c1ef078f

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        4da3bc2e1b8309ac443ed9d37ee718abdc61658a

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        60b80bb110404594d4fddc3d06fdc2733625c38ddc90cd6ebc07695a583f6748

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        c9f9bf412a157c9931bccfe89be6dc29642cdabff3556aac919a154b7595cbb8fd81d9d049b5152709b266fee23bf056b3c340308a5160252feab0afd83ad146

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        10KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        fb7010f5d2130746f08233c070aa87ec

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        26920e444f5f10095d019ada138fedd41aac2777

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        fe6ceb8bf730fc655dfa09c90176589d2e9a47d0a95082ce0ae62e666f3282d5

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        3f5aa4e513aa46971988c25ab90d77736168ebb681299f3ad542d6d731647f999f0b4ec43ebef6a06a0276344a2479f519696576c258a4fa49b19db3ca1c435c

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        15KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        f3343ad384165598e812876635b77ff3

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        ca583987a0aebbd162732c68fec23030f99c4cf3

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        e636964461e93dde2f09857c5fdd8de171f6f4d6624ac780e32f3350c0278c45

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        433014786688a7aaea31fc6c2fb2f2d59919adbb670bc087829080f30892d9b4180a89d6d387aaaf0ce9c0fe870ec6497dea72d6adbdecd02637223c1027e1de

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        96B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        b9399feac140a73d84dadf1b1a55e9b0

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        57eb118a7f5fa5022febc0aa24ace86a84cfefb7

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        62c8ba89001ad3e9c2159be141bb4ce6dce1ba3c83f1f04abf5207e5168aec9b

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        32c2c7fa950a26825f43f717b2e122dca598b7a318e922bcf03cfc18a398b228daae6598135f60f8e3b69d2d01b5d92228a3c58dc4c6212f26cf2acbceaa441c

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        233KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        de849832501beec4ed3135716116634c

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        e21279d1ed5917b40c8aefd607efd4fd45bfaccf

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        fb5005b71ac95eeb8aa5097576a54686e2e0ea85c6cffd39c1063d49e68916be

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        f5ada08dffdef88eba3e5eee454ab593b3c70bfe762812c9cf6a790cb7ded1f509db813637715799c5764ca8162206f15658443273746bb724796a707383ace2

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        233KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        a0e57533303f3df9b392e02cb296b859

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        ea7506e294b464b956609178a4bdf0287d0d5295

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        ca7e67482b129bb466a1cdb89cc92d2a6169a46318d6e7c2380f1c58f4c38413

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        fc334a17879959a9d66b33c9a0f36c6b1efc7fe35e64e47e87a63e4ab177776a37e28028f7bbd1b3f5a97bf32d3b3155a619a9e70056ca93d2e8e3ad5ede1669

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        233KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        33db0802768a4ef3b9e9ae9ba5ac5a32

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        cb69c60e9f3f320aaf844130d6c29ea1951c9af7

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        9dd8722001f0608f6fef72547578cc5d583ae46dd23c0568e69c56a9a129f224

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        22fcf78cab77e6a6d1b32cfa278ca732b042ce5a3fd496b882bfadd938d995d5102b7cac738916a75b9b5378ab1697758359bfb91419513303745a5bd52644ae

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        152B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        f5391bd7b113cd90892553d8e903382f

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        2a164e328c5ce2fc41f3225c65ec7e88c8be68a5

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        fd9710650fc6774ce452b01fb37799cd64d3cdc282ac693e918e38322349fe79

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        41957bea3e09c2f69487592df334edc6e3e6de3ab71beb64d9b6d9ce015e02a801b4215344d5d99765abe8ab2396394ac4664fced9f871204453a79463cc7825

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        152B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        2905b2a304443857a2afa4fc0b12fa24

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        6266f131d70f5555e996420f20fa99c425074ec3

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        5298bdb27d48c2c2b5e67bdd435445ef5b06d9b36c11394705b413ff3d0f51f3

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        df85de0c817350d8ca3346def1db8653aaee51705822b4c4484c97e7d31282a2936fa516d68c298dcbbb293b044aa7101b3de0c7852c26e98ac6c91415162b53

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        152B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        3ee478f7c4d2926598847a63b220a6ef

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        fea53168560635616d2056895ee7425121fd0c46

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        f2af168c642988d69fe11a5aa64ba9a926cf64abb7784d138f2b5611705eb64c

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        ee2de378f48994411795d4be064f1ecdace8d8fee9df49de89adc1bea70d0d2883bc599c60fe7af43c065aa7594242bd6ccbd8ad08748edb40fc370721547f28

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7fd8dc5e-2f8c-4580-ac0b-7e414734da62.tmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        24KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        7ad9709100fb43b77314ee7765b27828

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        5cd0c406c08c9c1073b0c08169ccaffbd4ef6b98

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        04b61824ffce6fdbae4e6a527ae58b85813226ee28fe4d631feb76b5f936a1a9

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        fc55ee34b1107e298f2cfcb20dce42b5dbc98a7b68e72ed80a6ea594f66dff6f9e9cb70ad5ccbf5ad2171275f375abac1defd8dad4118afa280cd9c1d9f6a538

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        70KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        e5e3377341056643b0494b6842c0b544

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        d53fd8e256ec9d5cef8ef5387872e544a2df9108

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        4KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        bd46f616a7365d9207649ccad2b141e9

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        56424e580d3e7df7ee61365192c30561dd5b792a

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        87d800ef1d4b60d916c90e7fe2a200f7e708453f8635b22476b76e667c5e0d3d

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        125c4519b63baedb1d6b50686b4194d72d70ce0284fda0083fa43114d858d9b1d29bb4c94cdf5a02d0515c8980469280d020f3962e3e4e662c390112c4d92081

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        5KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        0b05da71a9b016fa51f893fdd493c718

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        5594f084afd5d22d5eb97602e4dcbed242e80672

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        5b937560534dc5a3428774789544ad6adc8c14231e04718273924670f89cb7db

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        183348e8768c9e317d4a5fccffb594d09636df5f1d0a3c4fead4144d63257740ac17e4b012af6d7128b902af0967e38aa84ae3006cfd2a4bb0e238b3b750263b

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        24KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        e122fc93c0ad25d45d09ba51a3e86421

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        bb52a7be91075de9d85f4a4d7baeecc3167c871b

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        a277c1c6fafd7a44b47d94e4bc3c0337a64a34d252e58722855aab09e6f52bee

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        12787aebefd6a5e4584ec8747a78538f948a16b214bdf81302036ae89e2c4563027847236a4770c4f780a9ca0ed03f29b1577bfb6f11feffad85b7a625324bf5

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\MANIFEST-000001

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        41B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        5af87dfd673ba2115e2fcf5cfdb727ab

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        d5b5bbf396dc291274584ef71f444f420b6056f1

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        16B

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        46295cac801e5d4857d09837238a6394

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        ad209e0b82a55915ed55b337079c006d

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        de6cca07884c2ada63d82eebb292d4e2ca38482c

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        123ab93e4d9823f57c3ffc4d4d9d224192c456752cf4d76a22eddb04476fe9d1

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        3456c092b60e07149d9612c0a4fd4b721a68fd866c3a155e30bd154741e6cb1c2474999c7a1770f32faa2025b90db53a99042d6fd11ff707ecef9e0dc4c7b76b

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_400.wmdb

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        987a07b978cfe12e4ce45e513ef86619

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        22eec9a9b2e83ad33bedc59e3205f86590b7d40c

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        f1a4a978ce1c4731df1594043135cf58d084fdf129dd1c8e4507c9e06eac5ea8

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        39b86540e4d35c84609ef66537b5aa02058e3d4293f902127c7d4eac8ffc65920cb5c69a77552fc085687eed66e38367f83c177046d0ecb8e6d135463cc142aa

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        511d9771f25a389113f426ad8305d651

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        c3323ebc33e647bf9064f027676814c2d3b78279

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        4efcdfe73b16ec61ff2046762611a3726de12894c7a81d21698764875d28d711

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        95e82f8e2a3581ea720afabe21385ff6aa1e3277152a71e02b60298a42051b06d030486455705fca91a69d10ace87bff8fe15a76409e5baefaeba5ead47ac3b6

                                                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\74d7f43c1561fc1e.customDestinations-ms

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        1KB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        9db03bc4e4ac85c73fdfec76b7a41e79

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        1fe0ea1aae8d50fa6b244134d1c92d18192cd4b6

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        cdf74932951d9e5594c50d13e1f696a365acef51872b9a14a776370a10f606e0

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        c0dc683849098afc90738757f7d131e8c8cdfa8e11147378a69dd3e305f8c0d2b78bff54a1d379d18e2444480d512af5d9e06f9ccc553304cb94eb7c4dc41118

                                                                                                                                                                                                                                                      • C:\Users\Admin\Desktop\kreo q zi.exe

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3.1MB

                                                                                                                                                                                                                                                        MD5

                                                                                                                                                                                                                                                        28ac02fc40c8f1c2a8989ee3c09a1372

                                                                                                                                                                                                                                                        SHA1

                                                                                                                                                                                                                                                        b182758b62a1482142c0fce4be78c786e08b7025

                                                                                                                                                                                                                                                        SHA256

                                                                                                                                                                                                                                                        0fe81f9a51cf0068408de3c3605ce2033a00bd7ec90cc9516c38f6069e06433b

                                                                                                                                                                                                                                                        SHA512

                                                                                                                                                                                                                                                        2cbf2f6af46e5fae8e67144e1ac70bc748036c7adb7f7810d7d7d9f255ccf5d163cce07f11fb6526f9ab61c39f28bdf2356cc315b19a61cd2115612882eab767

                                                                                                                                                                                                                                                      • memory/2460-656-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-666-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-633-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-634-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-635-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-636-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-628-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-632-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-630-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-622-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-623-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-10-0x000000001B5E0000-0x000000001B630000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        320KB

                                                                                                                                                                                                                                                      • memory/2460-11-0x000000001C880000-0x000000001C932000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        712KB

                                                                                                                                                                                                                                                      • memory/2460-657-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-631-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-661-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-660-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-659-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-658-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-664-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-14-0x000000001C7C0000-0x000000001C7D2000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        72KB

                                                                                                                                                                                                                                                      • memory/2460-627-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-670-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-669-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-668-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-667-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-673-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-672-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-675-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-674-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-15-0x000000001C820000-0x000000001C85C000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        240KB

                                                                                                                                                                                                                                                      • memory/2460-69-0x000000001F180000-0x000000001F6A8000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        5.2MB

                                                                                                                                                                                                                                                      • memory/2460-619-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-620-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-621-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-629-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/2460-624-0x0000000001310000-0x0000000001320000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/4928-9-0x00007FFBD6EB0000-0x00007FFBD7972000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                      • memory/4928-6-0x00007FFBD6EB0000-0x00007FFBD7972000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        10.8MB

                                                                                                                                                                                                                                                      • memory/4928-5-0x0000000000EE0000-0x0000000001204000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        3.1MB

                                                                                                                                                                                                                                                      • memory/4928-4-0x00007FFBD6EB3000-0x00007FFBD6EB5000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        8KB

                                                                                                                                                                                                                                                      • memory/5180-683-0x0000000007910000-0x0000000007920000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-678-0x0000000007910000-0x0000000007920000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-697-0x00000000059B0000-0x00000000059C0000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-700-0x00000000059B0000-0x00000000059C0000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-698-0x00000000059B0000-0x00000000059C0000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-699-0x00000000059B0000-0x00000000059C0000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-701-0x0000000007910000-0x0000000007920000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-696-0x00000000059B0000-0x00000000059C0000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-703-0x0000000007910000-0x0000000007920000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-702-0x0000000007910000-0x0000000007920000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-709-0x0000000007910000-0x0000000007920000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-708-0x0000000007910000-0x0000000007920000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-707-0x0000000007910000-0x0000000007920000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-695-0x0000000007CE0000-0x0000000007CF0000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-677-0x0000000007910000-0x0000000007920000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-694-0x0000000007CE0000-0x0000000007CF0000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-682-0x0000000007910000-0x0000000007920000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-679-0x0000000007910000-0x0000000007920000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-680-0x0000000007910000-0x0000000007920000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-681-0x0000000007910000-0x0000000007920000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-676-0x0000000007910000-0x0000000007920000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/5180-650-0x0000000007CE0000-0x0000000007CF0000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/7660-665-0x00007FFBB5020000-0x00007FFBB5030000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/7660-654-0x00007FFBB6850000-0x00007FFBB6860000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/7660-655-0x00007FFBB6850000-0x00007FFBB6860000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/7660-653-0x00007FFBB6850000-0x00007FFBB6860000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/7660-651-0x00007FFBB6850000-0x00007FFBB6860000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/7660-652-0x00007FFBB6850000-0x00007FFBB6860000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB

                                                                                                                                                                                                                                                      • memory/7660-671-0x00007FFBB5020000-0x00007FFBB5030000-memory.dmp

                                                                                                                                                                                                                                                        Filesize

                                                                                                                                                                                                                                                        64KB