381178d3a2ebb0aab4c11d2125f2fa247ffeccc561b4195155901c4b60e3941c

Analysis

user interaction
yes
max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Cloudflare_WARP_2026.3.851.0.msi
Size 129.4MB
Sample260423-jp1v8aev9x
SHA256 381178d3a2ebb0aab4c11d2125f2fa247ffeccc561b4195155901c4b60e3941c
MD5 c23b6c7dd8fb1742999f2a36abe8aa7b
SHA1 77b35a34987810873162e0df52a12da1455be580
SHA512 1dd7d2a97f49fc6f4a24fa9da188023be2f21753c54c4727c5ed959818f3fa93566e49e4414853884ed3273d34a10cdd3215236243cafb8a7a957b1946c1ad05
SSDEEP 3145728:WSBkxCbzSBXWH9T9G24tsljoYppeFPb8llVHvsuwro1WazaDnWb+cLKTWVenX26:WSBB2BA9CW+gVHh5xawVGXh
TLSH
T1C45833DA2111CC6EF5768C3B483D7A5895763DB4962298E303F4B3BA5873AD1E673203
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution motw persistence phishing privilege_escalation ransomware spyware trojan

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
4736	warp-svc.exe
4680	Cloudflare WARP.exe

Loads dropped DLL 19 IoCs

pid	Process
1552	MsiExec.exe
1552	MsiExec.exe
1348	MsiExec.exe
2336	rundll32.exe
2336	rundll32.exe
2336	rundll32.exe
2336	rundll32.exe
2336	rundll32.exe
1348	MsiExec.exe
2212	rundll32.exe
2212	rundll32.exe
2212	rundll32.exe
2212	rundll32.exe
2212	rundll32.exe
4208	MsiExec.exe
4736	warp-svc.exe
1552	MsiExec.exe
4680	Cloudflare WARP.exe
4680	Cloudflare WARP.exe

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2300	msiexec.exe
6	2300	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe

Looks up external IP address via web service 7 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
95	whatismyipaddress.com
100	whatismyipaddress.com
101	whatismyipaddress.com
102	whatismyipaddress.com
103	whatismyipaddress.com
104	whatismyipaddress.com
105	whatismyipaddress.com

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
1123	https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html	3624	chrome.exe

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
1544	sc.exe
4736	warp-svc.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\warp_ipc.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\aws_lc_fips_0_13_7_crypto.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\aws_lc_fips_0_13_7_rust_wrapper.dll	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\warp-cli.exe	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\warp-dex.exe	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\warp-diag.exe	msiexec.exe
File created	C:\Program Files\Cloudflare\Cloudflare WARP\wintun.dll	msiexec.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{9B7D1F41-A53F-468A-B3A5-B19CFD7DE647}\icon.ico	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI61A9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EDA.tmp-0\Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\e58467a.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{9B7D1F41-A53F-468A-B3A5-B19CFD7DE647}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D41.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4E1D.tmp	msiexec.exe
File created	C:\Windows\Installer\{9B7D1F41-A53F-468A-B3A5-B19CFD7DE647}\icon.ico	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EDA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EDA.tmp-0\Newtonsoft.Json.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BAC.tmp	msiexec.exe
File created	C:\Windows\Installer\e58467c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4D21.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EDA.tmp-0\Warp.Installer.Actions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI4EDA.tmp-0\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BAC.tmp-0\Warp.Installer.Actions.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BAC.tmp-0\Common.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BAC.tmp-0\CustomAction.config	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5E2D.tmp	msiexec.exe
File created	C:\Windows\Installer\e58467a.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4EDA.tmp-0\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BAC.tmp-0\Microsoft.Deployment.WindowsInstaller.dll	rundll32.exe
File opened for modification	C:\Windows\Installer\MSI5BAC.tmp-0\Newtonsoft.Json.dll	rundll32.exe

Launches sc.exe 5 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1544	sc.exe
2604	sc.exe
1768	sc.exe
4012	sc.exe
4288	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
2300	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3624	chrome.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fba334cb82b6afae0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000fba334cb0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900fba334cb000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1afba334cb000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dfba334cb000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134214046634970142"	chrome.exe

Modifies registry class 37 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\52824FB156B79AC4FAFF7B5B1EEC724B\14F1D7B9F35AA8643B5A1BC9DFD76E74	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\SourceList\Media\2 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\ProductName = "Cloudflare WARP"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\PackageCode = "DC6ECE85D4D467E40BA3ADB091DCE910"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\SourceList\Media\3 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp\DefaultIcon	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\14F1D7B9F35AA8643B5A1BC9DFD76E74\ProductFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\ = "URL:com.cloudflare.warp Protocol"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\DefaultIcon\ = "\"C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe\", 1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command\ = "\"C:\\Program Files\\Cloudflare\\Cloudflare WARP\\Cloudflare WARP.exe\" \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\SourceList\PackageName = "Cloudflare_WARP_2026.3.851.0.msi"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\Version = "436405075"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\ProductIcon = "C:\\Windows\\Installer\\{9B7D1F41-A53F-468A-B3A5-B19CFD7DE647}\\icon.ico"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\URL Protocol	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\14F1D7B9F35AA8643B5A1BC9DFD76E74	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	chrome.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\com.cloudflare.warp\shell\open\command	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\52824FB156B79AC4FAFF7B5B1EEC724B	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\14F1D7B9F35AA8643B5A1BC9DFD76E74\SourceList\Media\1 = ";"	msiexec.exe

Modifies system certificate store 2 TTPs 5 IoCs

defense_evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 0400000001000000100000002edae4397f9c8f37d1709f2617513a8e030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd82000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 19000000010000001000000011a2b3490cb6c379a89e76c3569452d70f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a0400000001000000100000002edae4397f9c8f37d1709f2617513a8e2000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 5c0000000100000004000000800100000400000001000000100000002edae4397f9c8f37d1709f2617513a8e030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a414000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd6200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6509000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900200045004300430000000f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd819000000010000001000000011a2b3490cb6c379a89e76c3569452d72000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A	warp-svc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\C3197C3924E654AF1BC4AB20957AE2C30E13026A\Blob = 0f00000001000000200000000cf408e20830ac839f2a12143ce4b3e53ac6a27b2338a504f200fa3a154c4fd80b0000000100000052000000530053004c002e0063006f006d00200052006f006f0074002000430065007200740069006600690063006100740069006f006e00200041007500740068006f0072006900740079002000450043004300000009000000010000004c000000304a06082b0601050507030206082b06010505070303060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003417bb06cc6007da1b961c920b8ab4ce3fad820e4aa30b9acbc4a74ebdcebc6514000000010000001400000082d1857330e73504d38e0292fbe5a4d1c421e8cd1d0000000100000010000000aa0f958845d6cf47c0442d3960f923a4030000000100000014000000c3197c3924e654af1bc4ab20957ae2c30e13026a2000000001000000910200003082028d30820214a003020102020875e6dfcbc1685ba8300a06082a8648ce3d040302307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f7269747920454343301e170d3136303231323138313430335a170d3431303231323138313430335a307c310b3009060355040613025553310e300c06035504080c0554657861733110300e06035504070c07486f7573746f6e31183016060355040a0c0f53534c20436f72706f726174696f6e3131302f06035504030c2853534c2e636f6d20526f6f742043657274696669636174696f6e20417574686f72697479204543433076301006072a8648ce3d020106052b8104002203620004456ea950c4a623369e5f288d17cb9622643fdc7a8e1dcc08b3a27124ba8e49b9041b479658ab2d95c8ed9e0835c827eb898c5358eb628afef05b0f6b315263413b89cdececb68d19d33407dcbbc6067fc24595eccb7fa823e009e981faf347d3a3633061301d0603551d0e0416041482d1857330e73504d38e0292fbe5a4d1c421e8cd300f0603551d130101ff040530030101ff301f0603551d2304183016801482d1857330e73504d38e0292fbe5a4d1c421e8cd300e0603551d0f0101ff040403020186300a06082a8648ce3d040302036700306402306fe7eb5911a460cf61b0967bed05f92f1391dcede5fc506b114646b31c210062bbbec3e7e8cd0799f90d0b5d723ec4aa02301fbcba0be23024fb7c6d80550a993e800d33e566a3b3a3bba5d58b8f092ca65d7ee2f00708686dd27c696e5fdfe56a65	warp-svc.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4868	chrome.exe
4868	chrome.exe
4680	Cloudflare WARP.exe
4680	Cloudflare WARP.exe
4680	Cloudflare WARP.exe
4736	warp-svc.exe
4736	warp-svc.exe
4736	warp-svc.exe
4736	warp-svc.exe
4736	warp-svc.exe
4736	warp-svc.exe
4680	Cloudflare WARP.exe
4868	chrome.exe
4868	chrome.exe
4892	chrome.exe
4892	chrome.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs

pid	Process
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2300	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2300	msiexec.exe
Token: SeSecurityPrivilege	3424	msiexec.exe
Token: SeCreateTokenPrivilege	2300	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	2300	msiexec.exe
Token: SeLockMemoryPrivilege	2300	msiexec.exe
Token: SeIncreaseQuotaPrivilege	2300	msiexec.exe
Token: SeMachineAccountPrivilege	2300	msiexec.exe
Token: SeTcbPrivilege	2300	msiexec.exe
Token: SeSecurityPrivilege	2300	msiexec.exe
Token: SeTakeOwnershipPrivilege	2300	msiexec.exe
Token: SeLoadDriverPrivilege	2300	msiexec.exe
Token: SeSystemProfilePrivilege	2300	msiexec.exe
Token: SeSystemtimePrivilege	2300	msiexec.exe
Token: SeProfSingleProcessPrivilege	2300	msiexec.exe
Token: SeIncBasePriorityPrivilege	2300	msiexec.exe
Token: SeCreatePagefilePrivilege	2300	msiexec.exe
Token: SeCreatePermanentPrivilege	2300	msiexec.exe
Token: SeBackupPrivilege	2300	msiexec.exe
Token: SeRestorePrivilege	2300	msiexec.exe
Token: SeShutdownPrivilege	2300	msiexec.exe
Token: SeDebugPrivilege	2300	msiexec.exe
Token: SeAuditPrivilege	2300	msiexec.exe
Token: SeSystemEnvironmentPrivilege	2300	msiexec.exe
Token: SeChangeNotifyPrivilege	2300	msiexec.exe
Token: SeRemoteShutdownPrivilege	2300	msiexec.exe
Token: SeUndockPrivilege	2300	msiexec.exe
Token: SeSyncAgentPrivilege	2300	msiexec.exe
Token: SeEnableDelegationPrivilege	2300	msiexec.exe
Token: SeManageVolumePrivilege	2300	msiexec.exe
Token: SeImpersonatePrivilege	2300	msiexec.exe
Token: SeCreateGlobalPrivilege	2300	msiexec.exe
Token: SeBackupPrivilege	4528	vssvc.exe
Token: SeRestorePrivilege	4528	vssvc.exe
Token: SeAuditPrivilege	4528	vssvc.exe
Token: SeBackupPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeBackupPrivilege	116	srtasks.exe
Token: SeRestorePrivilege	116	srtasks.exe
Token: SeSecurityPrivilege	116	srtasks.exe
Token: SeTakeOwnershipPrivilege	116	srtasks.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeBackupPrivilege	116	srtasks.exe
Token: SeRestorePrivilege	116	srtasks.exe
Token: SeSecurityPrivilege	116	srtasks.exe
Token: SeTakeOwnershipPrivilege	116	srtasks.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeShutdownPrivilege	4868	chrome.exe
Token: SeCreatePagefilePrivilege	4868	chrome.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeRestorePrivilege	3424	msiexec.exe
Token: SeTakeOwnershipPrivilege	3424	msiexec.exe
Token: SeShutdownPrivilege	4868	chrome.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
2300	msiexec.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe
4868	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 116	3424	msiexec.exe	98
PID 3424 wrote to memory of 1552	3424	msiexec.exe	100
PID 3424 wrote to memory of 1348	3424	msiexec.exe	101
PID 1348 wrote to memory of 2336	1348	MsiExec.exe	102
PID 4868 wrote to memory of 4376	4868	chrome.exe	104
PID 4868 wrote to memory of 4752	4868	chrome.exe	105
PID 4868 wrote to memory of 4752	4868	chrome.exe	105
PID 4868 wrote to memory of 3624	4868	chrome.exe	106
PID 4868 wrote to memory of 4244	4868	chrome.exe	108
PID 4868 wrote to memory of 4244	4868	chrome.exe	108
PID 4868 wrote to memory of 3984	4868	chrome.exe	110
PID 4868 wrote to memory of 3984	4868	chrome.exe	110
PID 4868 wrote to memory of 892	4868	chrome.exe	109
PID 4868 wrote to memory of 892	4868	chrome.exe	109
PID 4868 wrote to memory of 3700	4868	chrome.exe	111
PID 4868 wrote to memory of 3700	4868	chrome.exe	111
PID 4868 wrote to memory of 3580	4868	chrome.exe	112
PID 4868 wrote to memory of 3580	4868	chrome.exe	112
PID 1348 wrote to memory of 2212	1348	MsiExec.exe	113
PID 2212 wrote to memory of 1544	2212	rundll32.exe	114
PID 2212 wrote to memory of 2604	2212	rundll32.exe	116
PID 2212 wrote to memory of 1768	2212	rundll32.exe	118
PID 2212 wrote to memory of 4012	2212	rundll32.exe	120
PID 2212 wrote to memory of 4288	2212	rundll32.exe	122
PID 4868 wrote to memory of 4680	4868	chrome.exe	130
PID 4868 wrote to memory of 4680	4868	chrome.exe	130
PID 4868 wrote to memory of 4992	4868	chrome.exe	127
PID 4868 wrote to memory of 4992	4868	chrome.exe	127
PID 3424 wrote to memory of 4208	3424	msiexec.exe	128
PID 3424 wrote to memory of 4680	3424	msiexec.exe	130
PID 4868 wrote to memory of 5388	4868	chrome.exe	134
PID 4868 wrote to memory of 5876	4868	chrome.exe	137
PID 4868 wrote to memory of 5876	4868	chrome.exe	137
PID 4868 wrote to memory of 5140	4868	chrome.exe	139
PID 4868 wrote to memory of 5140	4868	chrome.exe	139
PID 4868 wrote to memory of 5376	4868	chrome.exe	141
PID 4868 wrote to memory of 5376	4868	chrome.exe	141
PID 4868 wrote to memory of 6104	4868	chrome.exe	142
PID 4868 wrote to memory of 6104	4868	chrome.exe	142
PID 4868 wrote to memory of 720	4868	chrome.exe	143
PID 4868 wrote to memory of 720	4868	chrome.exe	143
PID 4868 wrote to memory of 3332	4868	chrome.exe	144
PID 4868 wrote to memory of 3332	4868	chrome.exe	144
PID 4868 wrote to memory of 5300	4868	chrome.exe	145
PID 4868 wrote to memory of 5300	4868	chrome.exe	145
PID 4868 wrote to memory of 5664	4868	chrome.exe	146
PID 4868 wrote to memory of 5664	4868	chrome.exe	146
PID 4868 wrote to memory of 5832	4868	chrome.exe	147
PID 4868 wrote to memory of 5832	4868	chrome.exe	147
PID 4868 wrote to memory of 2380	4868	chrome.exe	148
PID 4868 wrote to memory of 2380	4868	chrome.exe	148
PID 4868 wrote to memory of 5976	4868	chrome.exe	149
PID 4868 wrote to memory of 5976	4868	chrome.exe	149
PID 4868 wrote to memory of 6052	4868	chrome.exe	150
PID 4868 wrote to memory of 6052	4868	chrome.exe	150
PID 4868 wrote to memory of 6032	4868	chrome.exe	151
PID 4868 wrote to memory of 6032	4868	chrome.exe	151
PID 4868 wrote to memory of 6096	4868	chrome.exe	152
PID 4868 wrote to memory of 5440	4868	chrome.exe	153
PID 4868 wrote to memory of 6096	4868	chrome.exe	152
PID 4868 wrote to memory of 5440	4868	chrome.exe	153
PID 4868 wrote to memory of 2492	4868	chrome.exe	154
PID 4868 wrote to memory of 2492	4868	chrome.exe	154
PID 4868 wrote to memory of 5824	4868	chrome.exe	155

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Cloudflare_WARP_2026.3.851.0.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2300

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:116
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 547B9E2180D87D2483F315F05715306D
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1552
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 2198BF33D7DFCBF500D8EA33CB08F62B E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI4EDA.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240668437 25 Warp.Installer.Actions!Warp.Installer.Actions.CustomActions.ReadCmdLineParams
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    PID:2336
- - C:\Windows\system32\rundll32.exe
    rundll32.exe "C:\Windows\Installer\MSI5BAC.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240671656 36 Warp.Installer.Actions!Warp.Installer.Actions.CustomActions.InstallService
    3⤵
    - Loads dropped DLL
    - Drops file in Windows directory
    - Suspicious use of WriteProcessMemory
    PID:2212
  - - C:\Windows\system32\sc.exe
      "sc.exe" create CloudflareWARP binPath= "\"C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe"\" displayname= "Cloudflare WARP" start= "auto"
      4⤵
      Network Service Discovery
      Launches sc.exe
      PID:1544
  - - C:\Windows\system32\sc.exe
      "sc.exe" config CloudflareWARP depend= "wlansvc"
      4⤵
      Launches sc.exe
      PID:2604
  - - C:\Windows\system32\sc.exe
      "sc.exe" failure CloudflareWARP reset= 86400 actions= restart/0/restart/1000/restart/5000
      4⤵
      Launches sc.exe
      PID:1768
  - - C:\Windows\system32\sc.exe
      "sc.exe" failureflag CloudflareWARP 1
      4⤵
      Launches sc.exe
      PID:4012
  - - C:\Windows\system32\sc.exe
      "sc.exe" config CloudflareWARP start=AUTO
      4⤵
      Launches sc.exe
      PID:4288
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DB354BE6FE68BD6591C8E5F8ED5F90F7 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4208
- C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
  "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  PID:4680

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xa0,0xfc,0x120,0x9c,0x124,0x7ffd5106c728,0x7ffd5106c734,0x7ffd5106c740
  2⤵
  PID:4376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1752,i,7440914693948539901,6341054665597093736,262144 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1604,i,4158833087947696767,17358252322277341221,524288 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - System Time Discovery
  PID:3624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2424,i,18446237682682309489,12288391926373112547,524288 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3184,i,3291915361875285023,5857135605061625595,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:892
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3220,i,16299687374890770826,217700010299437810,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,16841290039312213207,11490479174419223123,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4448 /prefetch:2
  2⤵
  PID:3700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,10051212677541963798,6612472385236827723,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=4864,i,1851151052362108027,4758549499737055151,524288 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4880 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=5040,i,9965649756152618975,13413662665450958735,524288 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4860,i,12719838995714830466,1181094876192519779,524288 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:5388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --metrics-shmem-handle=5892,i,14254851726084208549,7747686612956377471,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:5876
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=3340,i,10516314208295417477,587822663569275132,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:5140
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=3500,i,896334588958734754,295412908479366657,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5660,i,7939296122345063152,11756480114704527451,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=6104,i,1867653615753566367,13984830636935878276,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:720
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=6312,i,9177668279621879164,9745250708651714974,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=6336,i,4286773279794068411,15590266012937455177,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6596,i,11073497378688617019,4799588855000011009,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=6768,i,4227090482560900850,2919754436008358073,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:5832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=6904,i,15637101817050488722,15531849353443602922,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=7108,i,2118639669454724200,18102398591118147388,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7088 /prefetch:1
  2⤵
  PID:5976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=7264,i,5307127610296013705,10915728675975068998,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7236 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --metrics-shmem-handle=7400,i,8648962225083106281,8734192972360846441,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7416 /prefetch:1
  2⤵
  PID:6032
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --metrics-shmem-handle=7444,i,15609680078229863576,13775157368810349195,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7552 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=7596,i,17465793492437998104,644601039830065664,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7604 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=7928,i,10745407915273325484,5521329546147189847,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7932 /prefetch:1
  2⤵
  PID:2492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=7096,i,16538012075247013591,2056006797305665704,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8044 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=8072,i,12451281523056933085,14379770412256479757,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7888 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=8108,i,6581677878286443553,6042297061670335556,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8160 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=8124,i,8058543681177700902,12424325318905287861,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8180 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=8128,i,7285259970170090981,11782635505130811432,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8204 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=8096,i,14951933748566049652,1773280504009354804,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8080 /prefetch:1
  2⤵
  PID:6152
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=8132,i,13431445057528360505,4853215725142752636,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8224 /prefetch:1
  2⤵
  PID:6160
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=8308,i,6788892708162483641,15694348945285778965,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8436 /prefetch:1
  2⤵
  PID:6168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=8408,i,12181335084599235328,4519771131423207961,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8984 /prefetch:1
  2⤵
  PID:6264
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=8444,i,11782029914666174046,15889439696087897103,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=9088 /prefetch:1
  2⤵
  PID:6272
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=8328,i,767285630656984747,14730044022944697892,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=9136 /prefetch:1
  2⤵
  PID:6280
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=9008,i,3004014739618622609,14657765313351314014,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=9040 /prefetch:1
  2⤵
  PID:6296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=8372,i,16501209057976921649,17618514869331165324,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=9932 /prefetch:1
  2⤵
  PID:6788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=10104,i,7481591723765727524,6658226974194474542,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=10100 /prefetch:1
  2⤵
  PID:6904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=10132,i,7290975898740827832,17578757706526724575,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=10140 /prefetch:1
  2⤵
  PID:6912
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=10276,i,17352411941048093676,14274041843925481387,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=10480 /prefetch:1
  2⤵
  PID:6980
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=10420,i,785670758407269847,7106092669812860222,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=10536 /prefetch:1
  2⤵
  PID:6988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=10396,i,7137338763248268400,2357933916900020168,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=10488 /prefetch:1
  2⤵
  PID:6996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=10432,i,14340470700373506232,2048466109513673661,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=10556 /prefetch:1
  2⤵
  PID:7004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=10408,i,11375975705728231457,18293577300410379589,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=10516 /prefetch:1
  2⤵
  PID:7012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=10600,i,4041916817022567008,12377784752568797359,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=10684 /prefetch:1
  2⤵
  PID:7020
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=10700,i,3296609257291119159,16272865126078407263,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=10716 /prefetch:1
  2⤵
  PID:7028
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=10760,i,9248204464622724821,1536850332395323748,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=10768 /prefetch:1
  2⤵
  PID:7036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=10812,i,11135132498905019544,4860392576744708626,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=10904 /prefetch:1
  2⤵
  PID:7044
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=10940,i,6759490401105129497,5542872684854200166,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=10944 /prefetch:1
  2⤵
  PID:7052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=10976,i,17254408816843050498,7459420889186778966,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=10988 /prefetch:1
  2⤵
  PID:7060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=11012,i,6131858586876458684,9877868023670498320,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11028 /prefetch:1
  2⤵
  PID:7068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=11060,i,10618865403539462845,15842377466448193792,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11064 /prefetch:1
  2⤵
  PID:7076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=11092,i,1972000234078828814,8419822737046682810,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11108 /prefetch:1
  2⤵
  PID:7084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=11136,i,10795968148416805952,16204994019446567580,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11132 /prefetch:1
  2⤵
  PID:7092
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=11160,i,17165876254220910903,11730041918540816878,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11168 /prefetch:1
  2⤵
  PID:7100
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=11184,i,14465187014793208636,2500622362819453589,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11228 /prefetch:1
  2⤵
  PID:7108
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=11196,i,10930988282463166948,1529286988921256228,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11248 /prefetch:1
  2⤵
  PID:7124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=11284,i,13395476966277589166,7628251540035443961,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11312 /prefetch:1
  2⤵
  PID:7144
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=11348,i,1901149662306427540,10092557533931657565,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11352 /prefetch:1
  2⤵
  PID:7156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=11388,i,9345677581895897426,12989516277314646750,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11396 /prefetch:1
  2⤵
  PID:7164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=11420,i,14919307469107927202,775364533862242054,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11428 /prefetch:1
  2⤵
  PID:5624
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=11460,i,950815744499676687,7359555989468677315,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11488 /prefetch:1
  2⤵
  PID:6312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=11532,i,1114661378530883264,13416314935328025608,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11540 /prefetch:1
  2⤵
  PID:6316
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=13968,i,7632147371487926784,13721580342922760937,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=13972 /prefetch:1
  2⤵
  PID:8040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=9840,i,16669588882781522530,12483922016806212300,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8648 /prefetch:1
  2⤵
  PID:8300
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=14592,i,2130656577755721346,14654439898843930167,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8232 /prefetch:1
  2⤵
  PID:8312
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=9596,i,2304763073784042605,9338848359374490568,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:8332
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=14656,i,15683099407050277245,4126781382480843314,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:8348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=14668,i,3006385697607996232,12065543096486209432,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:8352
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=14600,i,14358728881391687220,3856958168859371025,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6056 /prefetch:1
  2⤵
  PID:8360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=14688,i,7085357290827719788,13913305576236831373,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11996 /prefetch:1
  2⤵
  PID:8372
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=14700,i,9798887786676784867,2421335264413726606,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=9068 /prefetch:1
  2⤵
  PID:8380
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --metrics-shmem-handle=14712,i,323321678369035566,3757048842368490614,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=12384 /prefetch:1
  2⤵
  PID:8388
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=14764,i,16278279181465317845,5256774320725417140,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=9992 /prefetch:1
  2⤵
  PID:8392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --metrics-shmem-handle=14776,i,6222084211711559390,8920500581535919703,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11664 /prefetch:1
  2⤵
  PID:8400
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --metrics-shmem-handle=14792,i,7626551191088030859,10536699274541795866,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=12336 /prefetch:1
  2⤵
  PID:8412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --metrics-shmem-handle=14788,i,3276118261597130527,18417671337814355977,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=13296 /prefetch:1
  2⤵
  PID:8424
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --metrics-shmem-handle=11360,i,14888562159143871096,7141349402295790152,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=14088 /prefetch:1
  2⤵
  PID:8428
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --metrics-shmem-handle=14136,i,2972036045461924507,64167552184435452,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11420 /prefetch:1
  2⤵
  PID:8440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --metrics-shmem-handle=14172,i,17442605787844414560,15533374172293035657,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=13528 /prefetch:1
  2⤵
  PID:8448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --metrics-shmem-handle=15300,i,13106200583080587114,12839461018212529669,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=15288 /prefetch:1
  2⤵
  PID:8464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --metrics-shmem-handle=12216,i,18395700106372535088,9596778423545886523,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=10408 /prefetch:1
  2⤵
  PID:8472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --metrics-shmem-handle=15316,i,522405379627001582,2215941420163185273,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=14100 /prefetch:1
  2⤵
  PID:8484
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --metrics-shmem-handle=15304,i,2941078813015543738,13527018062073425592,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=9952 /prefetch:1
  2⤵
  PID:8500
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=88 --metrics-shmem-handle=15004,i,9828336172957633982,12400466616140210635,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7928 /prefetch:1
  2⤵
  PID:8496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=89 --metrics-shmem-handle=14980,i,15548448004227787370,13482446289775108850,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=10040 /prefetch:1
  2⤵
  PID:8512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=90 --metrics-shmem-handle=14952,i,75683762900971187,10323138696652692093,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=13744 /prefetch:1
  2⤵
  PID:8520
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=91 --metrics-shmem-handle=14936,i,13805829135305414063,11538173058679885523,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=14956 /prefetch:1
  2⤵
  PID:8528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=92 --metrics-shmem-handle=14748,i,4192289414125596239,1619960932084202612,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=12116 /prefetch:1
  2⤵
  PID:8544
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=93 --metrics-shmem-handle=14232,i,11243460104758277480,14768003528681375980,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=14532 /prefetch:1
  2⤵
  PID:8536
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=15264,i,77864401078263887,3838885825124139546,524288 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=14900 /prefetch:8
  2⤵
  PID:8552
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=15252,i,2456926920621718840,10933137040368699759,524288 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=13300 /prefetch:8
  2⤵
  PID:5616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=15248,i,738452720184527842,3743340477136824503,524288 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=12188 /prefetch:8
  2⤵
  PID:8568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=97 --metrics-shmem-handle=15208,i,16249342496137659548,9127376374861838473,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11228 /prefetch:1
  2⤵
  PID:8588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=98 --metrics-shmem-handle=15236,i,3789818959154309505,13799002244043967370,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=10572 /prefetch:1
  2⤵
  PID:8636
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=99 --metrics-shmem-handle=11696,i,5468107481437904790,13248100818420576243,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11772 /prefetch:1
  2⤵
  PID:6716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=100 --metrics-shmem-handle=8008,i,14926136561935837326,8506151674455223177,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7944 /prefetch:1
  2⤵
  PID:8048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=101 --metrics-shmem-handle=10820,i,6695996866164587833,11491499712524556351,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=14232 /prefetch:1
  2⤵
  PID:7412
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=102 --metrics-shmem-handle=10048,i,16583461897271147126,16724172473421208007,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:7132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=103 --metrics-shmem-handle=7232,i,10430822758471768880,2403990116600985239,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11720 /prefetch:1
  2⤵
  PID:7172
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=104 --metrics-shmem-handle=13688,i,7993899166554453333,6832355200934763498,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=13700 /prefetch:1
  2⤵
  PID:7464
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=105 --metrics-shmem-handle=11768,i,8021227043247456143,6175869740763911057,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=13732 /prefetch:1
  2⤵
  PID:7452
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=106 --metrics-shmem-handle=14076,i,7659156244857853091,15975923962503971747,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=8032 /prefetch:1
  2⤵
  PID:7468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=107 --metrics-shmem-handle=8284,i,2114279012596995445,12803274374677503214,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11764 /prefetch:1
  2⤵
  PID:7460
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=108 --metrics-shmem-handle=12096,i,18344317188593432339,13972373508320998232,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=10828 /prefetch:1
  2⤵
  PID:7688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=109 --metrics-shmem-handle=15164,i,16465715715840741616,10174284709366774873,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=11380 /prefetch:1
  2⤵
  PID:8104
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=110 --metrics-shmem-handle=7888,i,12814252960838278830,6829804052553853023,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=13684 /prefetch:1
  2⤵
  PID:8112
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=111 --metrics-shmem-handle=5672,i,14940498483506579435,18109013310648874227,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:7640
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=112 --metrics-shmem-handle=15032,i,2952933451828129639,13284934053526139672,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=14920 /prefetch:1
  2⤵
  PID:8244
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=113 --metrics-shmem-handle=15404,i,8635452297935671365,13577765261959205929,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=7888 /prefetch:1
  2⤵
  PID:8600
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=114 --metrics-shmem-handle=15740,i,13358082491033410947,8050884926074243451,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=15712 /prefetch:1
  2⤵
  PID:8392
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=115 --metrics-shmem-handle=16136,i,6274113784647070136,18133602142514102530,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=10384 /prefetch:1
  2⤵
  PID:8472
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=116 --metrics-shmem-handle=16148,i,3157020318523262726,16838977845964802571,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=13804 /prefetch:1
  2⤵
  PID:8684
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=117 --metrics-shmem-handle=16164,i,5714659519920393255,13645231144219795316,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=15352 /prefetch:1
  2⤵
  PID:8732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=118 --metrics-shmem-handle=16200,i,2913029170374279613,13533018598935171,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=16120 /prefetch:1
  2⤵
  PID:8660
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=119 --metrics-shmem-handle=16220,i,9194434749519855825,15778226319491222556,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=16208 /prefetch:1
  2⤵
  PID:8588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=120 --metrics-shmem-handle=16256,i,415628022613277139,14200350514084961163,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=15196 /prefetch:1
  2⤵
  PID:8524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=121 --metrics-shmem-handle=16360,i,6508890433131379423,11838925773967304147,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=15364 /prefetch:1
  2⤵
  PID:8444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=122 --metrics-shmem-handle=14324,i,11334757162383105762,4551678833013195886,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=17120 /prefetch:1
  2⤵
  PID:8508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=123 --metrics-shmem-handle=14692,i,13981766196601490596,947123397555774434,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=13756 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=124 --metrics-shmem-handle=17732,i,8201896496108779950,3563178579408960177,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=13972 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=125 --metrics-shmem-handle=8576,i,2377440143224592075,15483140802861677362,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=13264 /prefetch:1
  2⤵
  PID:7080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=126 --metrics-shmem-handle=17576,i,1700058728537396631,17885633897817667279,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:7064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=127 --metrics-shmem-handle=14448,i,9277473270184821660,8746177111240291290,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=14428 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=128 --metrics-shmem-handle=9328,i,5456329761827615701,4944212460628818008,2097152 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=13460 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=10964,i,6954531902574707977,1297213775188482969,524288 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=14456 /prefetch:8
  2⤵
  PID:7768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=17604,i,3056279618582058962,3915611392693208431,262144 --field-trial-handle=2040,i,16892768571330911371,4259276875310068199,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=17580 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4892

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:4316

C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe
"C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Network Service Discovery
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:4736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58467b.rbs

Path C:\Config.Msi\e58467b.rbs
Size 162KB
SHA256 b0c9002f0ae9f251b44b0c3a4090c383c43c061096dffb5b57db1b1f0f3d3744
MD5 740eb086fb3b34c07d481f2636c971e8
SHA1 b40723f39fece166911ebd4530428b6992b93305
SHA512 388ecee0966b24eb3b7bc3b3a2972dbd4d062a754e48d394121a9a67e2eb0a893bbe5bfcb806162e580babf05d5767affbbc06f3336579a23a33c8ac334baf96
SSDEEP 3072:VbJdLyE16iOLin7Q4RZUKnnH1uhC7vu/2nrZ/yqMPu6:xJdLT1jXZ/H1dRxt6
TLSH
T130F3AF0171D080B2EABF19355520DB722F7FBA609B508A9B439D8A7D9E702C09F75B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aws_lc_fips_0_13_7_crypto.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\aws_lc_fips_0_13_7_crypto.dll
Size 2.1MB
SHA256 e4a10a4411012dd93432f650e55cd8a5cabd7ec29efa6a568b50b24ebdb1e399
MD5 b9f5744a5bac8d33810e4c1656d09c71
SHA1 dc8eb1eff7eb1be58851a6b04938ededfb98bc25
SHA512 bcd7881d1f7ed0e1e8d6dd1f22dd21e2f4dbd16f2573118f7d613563bfa90bf2bc4dcd42ea0472aaf9f5240e211504a1b75d2ada84b62ad0208f3ad5cfa17452
SSDEEP 49152:7VwASOS2e4ysGJWO3z3iwGIVCDlEsidhwfxbUZHIU6iZ:Sm3trJ+o+Z
TLSH
T1BCA59D95A2B404E4D8B6E239CB53653BD27034198374FBEF07B047A92E53BEA553E702
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

warp_ipc.dll

Path C:\Program Files\Cloudflare\Cloudflare WARP\warp_ipc.dll
Size 4.6MB
SHA256 0ea586164d84abfd615e302283927f446b6ff7d2dac5a32777e402a3b619ac7d
MD5 c583d5fd3268bcf0599883c69149829b
SHA1 fcb643cb076f9cad69a6c6ae57e19091556f8488
SHA512 b97c32c7efae4f6a3930fa9f3e2a1b440d6a037520895456bd96e1ddbdca8ad41cb9d62fc82cd44f1c56affaf928311fe0d205a3f5f2cfa79d368ca14fdc7c21
SSDEEP 49152:0QX/qB0G8PE0rDe9frj/w+lgDzAe6cNTP7vCCar8vw1/OFz3/AtAABxOHPL3Hu7s:5vIlWAU8ZYe7ilt
TLSH
T1A7262911BF5A99A9C15AC07883474A725A71B4CA0B31BAFF459446393F7ABF02F3C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 471B
SHA256 03ae48b7e300e9d8b827d3b35f6689c0e4fe5eb88d73e322dc7f249db45d5b91
MD5 0c8d9ca5d736102f7f23c128bfed1c7d
SHA1 dd932e6dc70c1e6da4a85fc74a7dc945d57bc439
SHA512 88c5d29b7fdb34ad525722187f941105c24ba45e92c8e904c7191ae715e14a0adab19cfe04c3c8ca179dc52eeeadd7e8b11c0a00dd0474c8cd32dfce2780e73a
TLSH
T11EF0DC6FE1F7B4E22D06EC3C17F80B612691A1FD45C3C25530B916C289DEAFAA14B619
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30
Size 727B
SHA256 00a2bdaaaa10ae908b2556cc8af77c2bbc366e2b4a95155d034310d44067e9f9
MD5 3b75c9bcee2ae4a3af86a957c8d26d8d
SHA1 87d4f80854f7a8fffef481de5d973f519a1dda02
SHA512 57f6ca593fea5a36f0e0966c9b803302c516ff3a6ab5da850ebf5c6ba71900133d850f0d33860d7cc5a772aba9cf021b1f6c89759b6e138217a92b47aa93280c
TLSH
T18F014442183425C4BD7A0E394E9C1EA7BB039112954501BB903B1147B4A1761FDA3734
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 727B
SHA256 d94ca0fd355aa72923fc9a664ecc97b5aeda9b3ddd73fdac3e56de696e7ca9f2
MD5 4646e06bb4c9250d80cf96bdec336508
SHA1 4604dc1f9de0f1a6717720c9e234f91bafc57cea
SHA512 802e463fb83a1f5a97f0fa22219ebf272874d327e5cc57bba9aec471df986a6efde1e79f1fb6f1299b2d19fbfe6f596bee2a9860283877893553c87c165da753
TLSH
T14201447F58BCDF507C204540A45C86FA3BFAD3C528C20B5F167560BE21DE159161B372
MD5 SHA1 SHA512 TLSH

Submit Download

698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
Size 400B
SHA256 4beb291c8e8b530d1c8286a02b1c258c1a16aa2e6bad48b2cde6c8a2fcd825dd
MD5 233e1254fa5b95d6f584aac0c3845e37
SHA1 448609b39504743930f2fe039af94e29b06bfdde
SHA512 3da2a4938d87ddccf6a3a49b2ee9c8ddcd7e5d10583590525d53b888e36ecc75bbc7b4364694ac0ffc59debb41b869cc95dda68d4f39438159003f90161c0657
TLSH
T173E0C03027FE012EF1B0977853D5C086AB26F1032C5492FF18C21C5E6916E109C52C30
MD5 SHA1 SHA512 TLSH

Submit Download

8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30
Size 404B
SHA256 522669c0052df91656b5e0cc66c03fc32611b3590c0a00547bbc283af16f43a0
MD5 bbbe6a57a1c7ff22e20ca601382867da
SHA1 c664207bb4b00cb5a4c636951e4145ba22a58288
SHA512 3a0bdd64ffac7282f047e6c02fcc050c29b6e2e1d348062b27615fc571774997adbf9f2d19a6f1a6641a41affc020b46e1a25ba1b3c32d2d06d4db6b2a3d12dc
TLSH
T1C4E0C03431F94559F1F4913442F59D52695DF14319659A7910C06782BA127400CE1634
MD5 SHA1 SHA512 TLSH

Submit Download

C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
Size 412B
SHA256 2af736fe26f87c8b0c60df3137bb57c42eb34cbb6441cf9c6bc87d8b3af0a3a0
MD5 3f9f3f923bc2481e3203e44b4bcaf000
SHA1 b3b80e4c98aa9ed72498e7ac5ad06adfda9549c0
SHA512 3011b9d1edf5eb18247b35fbcfb4cf039d7bebb68ceb52ae3dce1d43becefabe87d1bbc6c46888045b91ee315ca4bce94ad11a6e12e4332723628c1aaac1a4c6
TLSH
T16FE0682812AFA55EF260ED3146EDF1711E48E302244492791591430CB716F044C14BF5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 4e7daaf1b15d3910b0dc08c4116a77c0f2d6cbdeceb2838a4d52a220cff2ec59
MD5 04f16d37e6b61dbcfa43ed4a2a3ad0f2
SHA1 cfb3a6dc90986191df5328b70bf461ac75cec17c
SHA512 3d1b3a5d68d61792b7a8be2a0e25b29402f003746fbe0ed3c8796911e0e702b2e26e3f6703862af76326bd909877c6aeb21f439a8b88f338678939079e7a82a4
TLSH
T191E061ABC961DC371CFD072920845745E705035F1F51954F3A3C820C8FF027A9286C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000054
Size 73KB
SHA256 0a5ffc7f6fef62c4f19f415635193276804d39ff774d4f39537afff53b646042
MD5 ccc68a01b9b8c9778994e7771bba69c8
SHA1 839245645a834d1b4e92af437bc0150a8b09b9ee
SHA512 f1d087dd377d91311c469f8ff26785664f9aca535bcf027e9959fb9794b78dad5fef91c97538a485bf1647c919948354d328e37964a48fc9148f8d408b26b955
SSDEEP 1536:9+BtIuGx2g9hqmCs7pV887zFOCWwS5Z9jBV/mGyFL9u8M+AB4:KtVGllV8DCWH5zNA5M+M4
TLSH
T1547312802BEDEC135DAEB093C44590E83EBABDDC10F5E9195700FD8746B85CDA62B17A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005d
Size 158KB
SHA256 60072b4eb6fc5f1f1214a34fcd55b3cbd1d05eddf778f85611f9b352c4c6452d
MD5 83266658f29f5cb762001d5d9f6985a7
SHA1 9ff52157193e1e798944e6a3172d938183f5e550
SHA512 60b2a8749bb597b71c6cb7113c4ea6c430ab90c6f6a5f78a36ab5fbd2676fbc173ade236be939e862569c786fbdc8e0aa984f1ae4263e91de2ba681cc8ce5d66
SSDEEP 3072:pqj6fcYjfI87fn/NWUEu+Y4rwgnWSPrrGh9SC2VRvkQdv45cf+Fg:pTvjg87fnVTEu+W3rSC2VRpBf+y
TLSH
T196F3232CABB1EF2298ADD32D789EF491C870553AC097303BB84FDF8575154348A7684E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00005f
Size 21KB
SHA256 1dd2574255aca661ac921813b702de55395669be7a18348647dcd36542b4063c
MD5 a649772bf21808c8c507461e94f3b7e8
SHA1 2fe5cb401fd22d5c29b1557556dac54cd69980af
SHA512 d3f59d9757f2aa1ca92151520683c14f8976239be27e7a9c15cd7446690299023c6d792d119ff23f707c31a4bad4c5ac4a34dce9fd3353b69935e65026f87ebb
SSDEEP 384:kw9/6ZkbuAz38w6gtwVLkMhLLk3mHHuFOkQzXQRNUNwmPvjxwXKJpKeV9SYMQlTL:ko/6Zk6A5twVQMhHk3mHHTjaUNwmHjyG
TLSH
T1DBA2E15F0F5210539C37120E1B0E40F63FE0DAD975A7C1A8E8F298A71D9E7EA6D980A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 29dc924f89806e71dd63b116214d74880121f9658480e57f9a658779350f3682
MD5 26b200f350fc43999d3d964188c0fd8c
SHA1 750fbc87c2b70854f882c92ad804e4173b0327aa
SHA512 fe70668bbe3d5f9f2893ec2282ad98afdf79d2438c32e626f4e4fefb89e51fddf9490a912adef084ee81b2d40a04b65c63415d74f5be1aade30eb0aacee4fc1e
SSDEEP 96:ADF3wXWLxhPasg8FEVY1gdwNTm8JjpstsGz:+3wmLDasgEGwlTpsqK
TLSH
T18F81EB98A4D0D129EF6C4B7A04F0AC55743021957642BFFF80E8DBBE92273E8C68854D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8065abfeb3cbc066a2dd218ff96821e248933e805fd355e542610ec85667ec2c
MD5 18f0ea918ef1a9ff47df1080930aebfa
SHA1 c504e005f5eb690420ea458ea7d992011fa84aef
SHA512 64210804d7f9066ba0b04e33ee9d0c6f395c28ceec165a7a0f2713445405723585bd59a2a3bbc5f2314735c9fce3867690f1feb9de902383174ebe826e90b693
TLSH
T14071EB5DA9D0C128EF6C8A7D04B0AC59703131A5B9063FBBD5ECDBBD92373E4C684958
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
Size 87KB
SHA256 5dac216a271e4aa5384a6bede1308076dc3668280746c248531a718a7872a16b
MD5 eee33c0ea80bcbcf9f7903bc83657ffa
SHA1 b284d99ff1748a740e537fc776860273bf2bbfdb
SHA512 8f670153225eda9db59bd8f1b899df808e03722cb9bcd9da4268ccab9a861a2041922bd148442a500e504430b669d8caa1863bf3a0a5102c63c83c90f3a02ed1
SSDEEP 768:j612rVgtmXkWEiRt3KcbUo+aEIxfDpGBY6bD6h:cmvhUxIxLUBTg
TLSH
T1CA939EF792B8C23CBA5299F09A94EE168F6D0994032C3D9DC5D4FE8793B1523C542B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
Size 13KB
SHA256 db99cdaab36519c783ad9b841c49b8f8084d278d90f3803a82d02a921313c3ce
MD5 7d5e768db995d6eef103d6a7642f7899
SHA1 33199150757e4a9dcb2abfe253f38ac0febb70b6
SHA512 23d4f343f6372b9c7fbb2bedf7dcc96b12f30d44b82a86c8c9cfc60f0fccff8cdc5cb916d1d73ae08599b6cdb612bf045e5eec04722ceb31389593d18890db3a
SSDEEP 192:JRWcBzNo+JLokYmv7rhAPRp2/209+Hsb+WNnUS4xH2UR/a25gcCVyIsnAUgtaJ:JRWmzNtazSf8XaEw5u2qa2zC8
TLSH
T14452C71EB9146A7B9CDAD22AFD217717D7F5202171981E84EAF8CA2C15E75CC221B02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
Size 17KB
SHA256 4c5dbe3f3071c1cdd70e39a99dd2a8e7a0233b08f2fef9e58bef03d6b9f0f954
MD5 eaf45e095eaf8d2e1b455626d5895959
SHA1 23bbb40f8390c77932f41805e60e5023c08cbcfb
SHA512 92ecc61b66421f057e483c277097699444f9b664b973b2ed4406a72d4c026914714c5b5c5496330675ccc8e112b23772dfe4e83882fbc0b2de5ba584e72837e6
SSDEEP 384:Wcji97KxkXqKf/pUZNCgVLH2HfgslE27pLuLcifU1XODid+ErU3+NHGSdTFO:Wwi97KxkXqKf/pUZNCgVLH2Hfgs227pA
TLSH
T1EB72F8676C0C9E3B4F98C68CD9267F4FACB5014B65EA885493FA982903D5BCB11061FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 4a7778e5bfb7a9557028d1e3b9116801b4939fe1d82b1137e1dc3c4d3bf0a099
MD5 7e935ffd4cb834442b6b8acbec4c2c24
SHA1 2214062f3f600e9da15af1211df8042e9cca6995
SHA512 39e74dc5b3a62701ebb0d781fb7134af077497f4f3bb5ea5de1f17f404a25b43029051b161df4267731b36cef505457a96e94a197111f0bec6e15338e476ce31
TLSH
T1A2B01211C001A602C06F02B02193C4C83314AF50D705230193E069B5F8269A28128151
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c222.TMP

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c222.TMP
Size 96B
SHA256 714da62d3aecbd0a401e778dce100af26f51cc4889484a9aee8415ee6c022a16
MD5 79ee3af3e1451253bff1c72f7bff6604
SHA1 b85ddac9e000caddcf8684070a484f8b68e5a760
SHA512 83cf616d42ff767ed6e2e5814eebb70b404321eae41489a7d7085139316e28e6953b74c190d087736ea8501dffad3dec9cb5aaf273b649511396aaf2d9af9066
TLSH
T1D1B00275C102A222C0C603B125959ADD7264EF25C603A25292E02A66DC396728AB6668
MD5 SHA1 SHA512 TLSH

Submit Download

4a87d5b5740cfa1d_0

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\4a87d5b5740cfa1d_0
Size 63KB
SHA256 db72306e8c7ccbec462ffd6e5e864f3794e1e732c6f10480a0d869ed93551db7
MD5 fec53f66ad335fcab9eb87a63390bcc6
SHA1 2600f7dd1e1dc287acc2995cafcf416a531b1738
SHA512 9e97b02e2d2e3d3d66def0b79d0070d3259b3d6d19964b84f1132be563ecdad2c6a4603f8b2fe1251ab08791502ece5c868eb85625177d55ca05a536b0b62a9f
SSDEEP 1536:pwCzCbaO8ezOEjy7xk4yynTo3xR3iPFbjH:pwCzCt8eCoZ4zTBb
TLSH
T170537DA6336074778277A5F190AF230B313AE157F40089E8B198EEE54F45BAB1177B6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 dbf3fa8bc8b2928816eb4f2f83a70c03dfdd3c6d2b1c357b977def5456cc26b9
MD5 994a83e4302457dcd1b101092398f5bc
SHA1 9345b033ae5a9c2c6a596184f15551f38f974ea0
SHA512 631c01fd5094ecd359d8f3f3cb07ac0aeede25894550a9588fad8541ff8a8d4d120a29a6ef9061abc1ac02fdab5d02fef9e16583e07a36d75f8f039fd30c8e1d
TLSH
T157A0021083925E15C12C8274128107507356C9125771074380D1449D8D54292CD12006
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 195KB
SHA256 9b0add460e550685bc247dbb23677d96164cdc520265d1f95bd1b5ff38e3f1d8
MD5 b2b29161ce6a9fe76003ef65bbb3ba5a
SHA1 91189129cb003359edd8651462bcab2a61e0ba72
SHA512 663ae0bf602ef1a292c0361b8b5630d70410d3bc5d3e5d33321f563e2c4e09228c9771d39c32d969d74e3d97003bcbd79a1b32b7887dc0d19a09eecaf8f57670
SSDEEP 6144:es+QVAbAn5eCwWGwhLZF307mjrOk0HOGm/SFyEE9:zVOAnAXwtZu78rOjuGdF29
TLSH
T1FF1413BADD2E2DFB217E1B80706D270E8E7662CFD09D749E62016B8144991CA5F33D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 89KB
SHA256 9a76df42ec9b7f9b09c3449254c7b8478b7414e79fa823b59ca7a44f5f9ec3c1
MD5 199a5e422098871c3fea695548b10ffa
SHA1 6bc974abd3cd8a3300153799771aa2f54d49b11f
SHA512 034505b217cf66eabb795783316395f6177002eae320fb4e686de168248d1b6a017d48f874a24927f6684d6c46ae7ab33826b48b6d55a902a27f62c831fe1c9f
SSDEEP 1536:jVhcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:xh3Qw/xLANk0mUW5GmRntSFCjEENQ
TLSH
T18F9302BA5E174AE7957D4A9176AE7809CE12630D70AFA8CC315CA38C61D01C92F73E73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 b586d160141dbad2dc793ec8715793434dcc4b8eda6aa4e92c2956a9eec2ff16
MD5 107d19db4545fdeb67f87f872dfd68f2
SHA1 9b8d8a997e57089f534074d03a689c7b73177325
SHA512 573aabea1bdca900094007088926fbbd7d70dd10c431270c8f7ba37c9ea78d865e6533a073819b1e0dd1fdd2958716944fcde7de3b16dd41cb9da20a23066f85
SSDEEP 6144:c+QVAbAn5eCwWGwhLZF307mjrOk0HOGm/SFyEE9:UVOAnAXwtZu78rOjuGdF29
TLSH
T1841413BAD92E6DBF217E179071AD260E8E3262CF90DE709E2341668540D52CA1F73937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
Size 194KB
SHA256 d5a8c557c1ea30269deb776795a98a0864830d305b593026e993690c17b91f69
MD5 35a9fb1bad5a50c18530b243d069b113
SHA1 95b53e6671f9e1f626a149a9319b5b75b4ba0af1
SHA512 203858d9e18b21ed8e06c780ef224894663194adc38b50e3c31c1f863ee06b2386d17203f00966695245720bed0541b00f24a6a776b3d2dd75fda2de8db14a34
SSDEEP 6144:B+QVAbAn5eCwWGwhLZF307mjrOk0HOGm/SFyEE9:lVOAnAXwtZu78rOjuGdF29
TLSH
T1F51413BAD91E6DBF217E179071AD260E8E3262CF90DE709E2341668540D52CA1F73937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rundll32.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
Size 737B
SHA256 ab68e7ac87c905042b3ff21ea1e50b1eb48666b8e4834fd42c51295e879a9572
MD5 5727da8319619d065c7a43f9a7322529
SHA1 aacdde2f71d8c9f3993614bfed0d5ce754c2138f
SHA512 35d9459254824a051d94f3eba1151e49a8919a924c7a32ba2a6d3a40e29c0e43412e36d4629fe425112e434975367e12edda84f76b7325ac643f0a595d232e16
TLSH
T1D001C0703261B2D449132F02185C268447BF47256F54EE0C75AD725ED8290674F232F3
MD5 SHA1 SHA512 TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\Cloudflare WARP\VFF4u2a6H+Uav2cTFx2EoChEmC6mnEw=\PresentationNative_cor3.dll
Size 1.2MB
SHA256 390c7ab165434c2da59f620b363f14373c75ade83dbd7c0513974ad505953ba6
MD5 60dfddb86abd678448a8f021a49ac52a
SHA1 f23f2459d5f8dc31d0c01185e3d98a242aac3ecf
SHA512 7ed0652cd4134c6e6edafdf29036446ed44e93a8889f90268be879f2ee51736612b2798a6f17f4d29f4a9913fd1bd4b0bff05f6cdf6f31181ae03bcc9874a6c5
SSDEEP 24576:gSsBi4K1Xm/qOYBAwcZG8f+kLB1Tije/46WnwjdQKVS6fdZFUBelxUTd9WuryH/d:mRK1XnOYBAwcZP1TiO46WwjdQKVg9WfV
TLSH
T1D5453A22E2E642E4D47FC1B8C646972BFBB1740A131C66DB87608B552F27FE0963E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI80644.LOG

Path C:\Users\Admin\AppData\Local\Temp\MSI80644.LOG
Size 35KB
SHA256 a7cae8ee26ef3adaed5f1ecfb82373146fa5f1a2f8cf9cb33022652cedc6ee15
MD5 a8a92795a5c9a3ce5df0f7481c6abc59
SHA1 45a16b2a611d2d5db8634a5dab23d264727add48
SHA512 67c12bf8d6e9050bd10666c5e7224cc09a68034561fc0bfa62e5c10d9fd1a3fab4658867e66c11ef396e47e012a264dd1d7403d2dcd2adc0f240bda414f2a555
SSDEEP 768:SaSJZ3D0t9bCb+lnt9K110NmcVo0M1iEdKQoLcWw3k0k6WoUhTy:SfJZ3D0t9bCb+lnt9K16mygiEdKQo4WO
TLSH
T180F2EA352FF40108B6B7E683DFF34456AA73F96D6A35D90D6041C21D04B3D0AA97E3AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4D41.tmp

Path C:\Windows\Installer\MSI4D41.tmp
Size 149KB
SHA256 386a4209241d3424783e2456ef79988a1032a9f4ead891b5551253520e439ee0
MD5 8eabeadadc6d03c9807787af28381b65
SHA1 b5015709fb98a8a849a0440c54c07c394e89bc59
SHA512 18ddec2d28640108faf5a4b9878cc0e6224fdc6ee26bd9fcfc2c972d0ea82a21468181c6fcc3413a99e2a9bc070e71d41c998528a324eee93ee1b59351b6f037
SSDEEP 3072:CJdLyE16iOLin7Q4RZUKnnH1uhC7vu/2nrZ/yqMPu:CJdLT1jXZ/H1dRxt
TLSH
T171E3AE01B1D08072DABF193A5434DA725F3FB9209F508ADB53988A7D9E702C09E76B37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI4EDA.tmp

Path C:\Windows\Installer\MSI4EDA.tmp
Size 542KB
SHA256 043004a5c963bb150211bbd812ef84275c5095d65951786f7674c032f38bdffe
MD5 8b09c6262c389bb90accaa3c252855e9
SHA1 ed170328be0c4b8fc51f938f9493fcdebdcf54b4
SHA512 561f04fd0b61b587bf4007c3abe9c5424013b6b906a971f038d9b1221d89b0f1ed6bcd4ad726f2a90043135b8f5a1649a9ee1ff7b4295bf2c0704beeeb5bb042
SSDEEP 12288:+PVdJDcpje+7oBeBddgp+zTiAaDAFdVMs2fep+i:+dPydgkzT4ARwfeYi
TLSH
T1ACC4E02633F80DBAFCB79235C9234A05D6737C611930DB5F03A4025ADF6B794A939B61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Common.dll

Path C:\Windows\Installer\MSI4EDA.tmp-0\Common.dll
Size 15KB
SHA256 3f7ca0eeb1dd21da3c7e3520de81cd69f14606c4769084e346b004e8485eb770
MD5 0f907d122efd1e93d9a60303064ee546
SHA1 5c412f7efaeb992b20ecaca3f067170de0474986
SHA512 e33236476d0e045167c578b0e7ca137bec99c3db4a92e212fec5fc64f232cd84b24a72a0478b474c7d3cbf30bea2c4f6227b752f93d34095bf73e85da6f5a956
SSDEEP 192:86/odT6QmgaBE0z3tpqXRwrTm1m9pcqP6fU0W99a1jzaHg8XsEFtT1gOBNf4rqby:b7ga77iKm1lqP6Y99a1/aHsEf1P62y
TLSH
T15362F60563FC416EEABF5FBCADB113A24579F7527E02DE6F0A94804E0C3375A8460A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Warp.Installer.Actions.dll

Path C:\Windows\Installer\MSI4EDA.tmp-0\Warp.Installer.Actions.dll
Size 22KB
SHA256 48097b83109cd2ad999a8945b246699fde23a97d38cff85a84a25024da388bff
MD5 77b520f199be8c2b9c42b9d79e647cdd
SHA1 a43cfc7f8e2164a62b67a433037bc2781c03f048
SHA512 231e21c4f6c8011533a2e72aabd18494780dbea2bf23ee0312352ebef571674cc854ddf84fdf18c9d6a381c6727338a6e6331bf4485f6fc24234dd8c5b091b7b
SSDEEP 384:dfg3Lz+w3k8o+R06fUMrTftezgJEFlxw4P3bkzRsPo5djidYGUOfmsbv3XF:5gbzjkUf0Xbky0i6FsmUF
TLSH
T1D5A2A641B3F80625FAFF5F70BEBA111049BABC99A932C75D099440CE1877B8695A1F33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CustomAction.config

Path C:\Windows\Installer\MSI5BAC.tmp-0\CustomAction.config
Size 1KB
SHA256 5d6fd5049f33ac6b16ec0431787fa61c66630ba1916bb4c70f3f6b5844b74ecb
MD5 8c22d283225f3bdb8e36522c359796f9
SHA1 cec5168b62bc7d39930e0843a0a285c3d89ed23e
SHA512 826550987a6140b870894c02c20f1c890e187c5919fc60f5fe3fe962fc87bfcc3879ee1de6141d679aa85f6cf52f8be88a9b23a8d43b8561b6b70baf138ada3e
TLSH
T19731018E4A44A77721312767ABED91C1DB79A1AB3C91811834DE99242F16968137338A
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft.Deployment.WindowsInstaller.dll

Path C:\Windows\Installer\MSI5BAC.tmp-0\Microsoft.Deployment.WindowsInstaller.dll
Size 183KB
SHA256 791da16b0df6956e88b04dab8b543b99dc2abd9af24aa25208fe5a0981e811b3
MD5 c2c83128276cc7c9cccc399bb5d76031
SHA1 776f9ca8175d95d0bc7c44847d60091bdf415041
SHA512 c8651107f699daa299182dbe594da76cd794ba0d7661a483aaa932f0967a3af5761c8e8a3250cb501019d39b483d09427ac75aa7fa3a191a090e226d8d9fd515
SSDEEP 3072:pGfZS7hUuK3PcbFeRRLxyR69UgoCaf8xzCnfKlRUjW01KyPePc:lzMRLkR6joxfKK3
TLSH
T1CC047D2953FC473ACAEF4778E2614261D7B1F2E67117DB0E9C8181BA2522780F792397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI61A9.tmp

Path C:\Windows\Installer\MSI61A9.tmp
Size 234KB
SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
MD5 8edc1557e9fc7f25f89ad384d01bcec4
SHA1 98e64d7f92b8254fe3f258e3238b9e0f033b5a9c
SHA512 d26c9dce3c3d17583ffb5dbcd3989f93b096a7f64a37a2701a474c1bf4b8c8b1e922c352d33f24e411f1c793e1b4af11a3aec1de489087d481b1b636df2050cd
SSDEEP 3072:5XiqyhTO8W0iEa8LW0bEC9hvZpC01v+eUKflQnZl+T+J7g6EsNr7wyy/IP3:5qhy8VKU3hvZUy+ppHEsuB/
TLSH
T159348D217494547EEBFF0832953AD671AE3DF2380B90C96EC384581E6D618C1A7B7B27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 990088f1196cf8eef40eebacf5d2b04a7f63d003f1333770e58b5403fbb883f4
MD5 36b3c46290b90b3312dd11e5d6771505
SHA1 7603f82e025168d4fc70a1ab9f34e3f9e96ca172
SHA512 6103f62600409ab42e646185af49bdfc223eba6e176f87589f40e7529d6f57593f23424858f5b8177fb29c03b87814275b76387edfdec0d905bf82ff77d8ee22
SSDEEP 24576:Ou8m+1zYdoO/vvTLr2du42aJc0EDV1tSRrmNfSs110ac+6kgo/l0VLmxI:p
TLSH
T19C47B12436F92200E7B79E3CA8F0AA634D3E7D5B9C159E8D45411B4E0921FB1E873F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6870ac43-4484-4663-888b-f6c657b6c2eb}_OnDiskSnapshotProp

Path \??\Volume{cb34a3fb-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{6870ac43-4484-4663-888b-f6c657b6c2eb}_OnDiskSnapshotProp
Size 6KB
SHA256 6b5159c2c2bf5a6940d6b169a55d1d1550c0898f2c2f87499cd0c023f194e75b
MD5 69934d627d6d5478aee1156df96a81f9
SHA1 9094b7c74e1772d26320e61d8307d0b5af410443
SHA512 ab38bbf1d8f43dbcc01b1815d3d6701a2978b46ea405e1a949fe80636b01d758b83ab0c67f70088d77a4fcd9c26db1934adbd589610386507c27b9602112f638
SSDEEP 96:FOx3f6GBtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:cJnb++ZVm
TLSH
T1B9D18A085AF54711E2B3AB3129F14557A877B811EF33CB8E0298638E2671A10F975F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1552-179-0x0000000000FC0000-0x00000000010E0000-memory.dmp

Download

memory/2212-130-0x000001C806200000-0x000001C80620C000-memory.dmp

Download

memory/2300-12-0x000002BAF49A0000-0x000002BAF49AC000-memory.dmp

Download

memory/2336-48-0x0000017A4FDF0000-0x0000017A4FE1E000-memory.dmp

Download

memory/2336-56-0x0000017A4FE30000-0x0000017A4FE38000-memory.dmp

Download

memory/2336-52-0x0000017A4FD60000-0x0000017A4FD6A000-memory.dmp

Download

memory/2336-57-0x0000017A682D0000-0x0000017A682EA000-memory.dmp

Download

memory/2336-62-0x0000017A4FD30000-0x0000017A4FD3C000-memory.dmp

Download

memory/3424-113-0x00000253DB2C0000-0x00000253DB2CC000-memory.dmp

Download

memory/4208-180-0x0000000000FA0000-0x00000000010C0000-memory.dmp

Download

memory/4680-347-0x0000014FE3D60000-0x0000014FE3D68000-memory.dmp

Download

memory/4680-234-0x0000014FC2510000-0x0000014FC251E000-memory.dmp

Download

memory/4680-350-0x0000014FE3E40000-0x0000014FE3E5C000-memory.dmp

Download

memory/4680-356-0x0000014FE3E20000-0x0000014FE3E27000-memory.dmp

Download

memory/4680-344-0x0000014FE3C70000-0x0000014FE3C7A000-memory.dmp

Download

memory/4680-341-0x0000014FE3D40000-0x0000014FE3D49000-memory.dmp

Download

memory/4680-338-0x0000014FE3DF0000-0x0000014FE3E11000-memory.dmp

Download

memory/4680-335-0x0000014FE3DD0000-0x0000014FE3DE6000-memory.dmp

Download

memory/4680-332-0x0000014FE3D70000-0x0000014FE3D8D000-memory.dmp

Download

memory/4680-329-0x0000014FE3D00000-0x0000014FE3D17000-memory.dmp

Download

memory/4680-326-0x0000014FE3D90000-0x0000014FE3DCC000-memory.dmp

Download

memory/4680-312-0x0000014FE3AD0000-0x0000014FE3ADA000-memory.dmp

Download

memory/4680-309-0x0000014FE3C40000-0x0000014FE3C48000-memory.dmp

Download

memory/4680-306-0x0000014FE3C20000-0x0000014FE3C33000-memory.dmp

Download

memory/4680-303-0x0000014FE3C80000-0x0000014FE3CDC000-memory.dmp

Download

memory/4680-300-0x0000014FE3B00000-0x0000014FE3B13000-memory.dmp

Download

memory/4680-297-0x0000014FE3AE0000-0x0000014FE3AF4000-memory.dmp

Download

memory/4680-294-0x0000014FE3AB0000-0x0000014FE3AB8000-memory.dmp

Download

memory/4680-291-0x0000014FE3A20000-0x0000014FE3A4F000-memory.dmp

Download

memory/4680-288-0x0000014FE3A70000-0x0000014FE3A91000-memory.dmp

Download

memory/4680-285-0x0000014FE3A50000-0x0000014FE3A67000-memory.dmp

Download

memory/4680-282-0x0000014FE3970000-0x0000014FE3995000-memory.dmp

Download

memory/4680-276-0x0000014FE3940000-0x0000014FE3969000-memory.dmp

Download

memory/4680-273-0x0000014FE7D10000-0x0000014FE852C000-memory.dmp

Download

memory/4680-252-0x0000014FC2530000-0x0000014FC253D000-memory.dmp

Download

memory/4680-249-0x0000014FE39A0000-0x0000014FE3A16000-memory.dmp

Download

memory/4680-246-0x0000014FE6C90000-0x0000014FE74D2000-memory.dmp

Download

memory/4680-240-0x0000014FC24F0000-0x0000014FC24FB000-memory.dmp

Download

memory/4680-237-0x0000014FE2C10000-0x0000014FE2C24000-memory.dmp

Download

memory/4680-353-0x0000014FE3FE0000-0x0000014FE4149000-memory.dmp

Download

memory/4680-231-0x0000014FC2500000-0x0000014FC2508000-memory.dmp

Download

memory/4680-211-0x0000014FC0B60000-0x0000014FC0B67000-memory.dmp

Download

memory/4680-208-0x0000014FC0B10000-0x0000014FC0B23000-memory.dmp

Download

memory/4680-205-0x0000014FC24C0000-0x0000014FC24EA000-memory.dmp

Download

memory/4680-199-0x0000014FE3350000-0x0000014FE3578000-memory.dmp

Download

memory/4680-223-0x0000014FC0B70000-0x0000014FC0B79000-memory.dmp

Download

memory/4680-220-0x0000014FC0B50000-0x0000014FC0B55000-memory.dmp

Download

memory/4680-202-0x0000014FE3580000-0x0000014FE36DE000-memory.dmp

Download

memory/4680-190-0x0000014FC0B90000-0x0000014FC0BD7000-memory.dmp

Download

memory/4680-187-0x0000014FE2B40000-0x0000014FE2BC2000-memory.dmp

Download

memory/4680-359-0x0000014FE3D50000-0x0000014FE3D5E000-memory.dmp

Download

memory/4680-315-0x0000014FE3CE0000-0x0000014FE3CF3000-memory.dmp

Download

memory/4680-318-0x0000014FE3C60000-0x0000014FE3C6A000-memory.dmp

Download

memory/4680-321-0x0000014FE3D20000-0x0000014FE3D32000-memory.dmp

Download

memory/4680-279-0x0000014FE3930000-0x0000014FE393A000-memory.dmp

Download

memory/4680-255-0x0000014FE2C40000-0x0000014FE2C45000-memory.dmp

Download

memory/4680-261-0x0000014FE2F00000-0x0000014FE2F16000-memory.dmp

Download

memory/4680-270-0x0000014FE3B20000-0x0000014FE3C14000-memory.dmp

Download

memory/4680-264-0x0000014FE2C50000-0x0000014FE2C68000-memory.dmp

Download

memory/4680-258-0x0000014FE2C70000-0x0000014FE2C89000-memory.dmp

Download

memory/4680-243-0x0000014FE2EB0000-0x0000014FE2EF4000-memory.dmp

Download

memory/4680-214-0x0000014FC2540000-0x0000014FC2580000-memory.dmp

Download

memory/4680-217-0x0000014FE36E0000-0x0000014FE3903000-memory.dmp

Download

memory/4680-226-0x0000014FE2BD0000-0x0000014FE2C0E000-memory.dmp

Download

memory/4680-197-0x0000014FE42F0000-0x0000014FE5278000-memory.dmp

Download

memory/4680-193-0x0000014FC0B30000-0x0000014FC0B42000-memory.dmp

Download

memory/4680-184-0x0000014FE2F50000-0x0000014FE3344000-memory.dmp

Download

memory/4680-181-0x0000000180000000-0x0000000180A25000-memory.dmp

Download