Overview

overview

7

Static

static

1

Cloudflare....0.msi

windows11-21h2-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    639s
  • max time network
    643s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    02/05/2026, 03:58

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Cloudflare_WARP_2026.3.851.0.msi
  • Size 129.4MB
  • Sample260502-ejk6csgz3y
  • SHA256 381178d3a2ebb0aab4c11d2125f2fa247ffeccc561b4195155901c4b60e3941c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Creates new service(s) 2 TTPs
    persistenceexecution
  • Executes dropped EXE 21 IoCs
  • Loads dropped DLL 64 IoCs
  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 7 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Service Discovery 1 TTPs 4 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in Program Files directory 36 IoCs
  • Drops file in Windows directory 64 IoCs
  • Launches sc.exe 16 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 5 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 22 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 15 IoCs
  • Modifies data under HKEY_USERS 38 IoCs
  • Modifies registry class 64 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: LoadsDriver 14 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\msiexec.exe
    msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\Cloudflare_WARP_2026.3.851.0.msi
    1⤵
    • Badlisted process makes network request
    • Enumerates connected drives
    • Event Triggered Execution: Installer Packages
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:2268
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Badlisted process makes network request
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:572
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 957A93DFE706F8802656CAEE9A3E6FF4
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3304
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 721989E3B75546BF446647AD99E4E803 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5612
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIB3DD.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240694296 25 Warp.Installer.Actions!Warp.Installer.Actions.CustomActions.ReadCmdLineParams
        3⤵
        • Loads dropped DLL
        PID:3160
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIBECB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240697031 36 Warp.Installer.Actions!Warp.Installer.Actions.CustomActions.InstallService
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4392
        • C:\Windows\system32\sc.exe
          "sc.exe" create CloudflareWARP binPath= "\"C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe"\" displayname= "Cloudflare WARP" start= "auto"
          4⤵
          • Network Service Discovery
          • Launches sc.exe
          PID:5192
        • C:\Windows\system32\sc.exe
          "sc.exe" config CloudflareWARP depend= "wlansvc"
          4⤵
          • Launches sc.exe
          PID:5684
        • C:\Windows\system32\sc.exe
          "sc.exe" failure CloudflareWARP reset= 86400 actions= restart/0/restart/1000/restart/5000
          4⤵
          • Launches sc.exe
          PID:5400
        • C:\Windows\system32\sc.exe
          "sc.exe" failureflag CloudflareWARP 1
          4⤵
          • Launches sc.exe
          PID:3084
        • C:\Windows\system32\sc.exe
          "sc.exe" config CloudflareWARP start=AUTO
          4⤵
          • Launches sc.exe
          PID:4144
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 9037DB3063CE70430A2B9A1E9BE4A96D E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:5164
    • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
      "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:4320
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding FBB4FBB99D4C4CAC1F018E45F94CA371
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2028
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI87A2.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240879562 62 Warp.Installer.Actions!Warp.Installer.Actions.CustomActions.CheckRepairElevated
        3⤵
        • Loads dropped DLL
        PID:572
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 3F7D87E262DC2AD78205B428A7287BD1
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:1476
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 416C3951CAAD9A2628658A457B18B87E E Global\MSI0000
      2⤵
      • Loads dropped DLL
      PID:32
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI8B9F.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240880578 98 Warp.Installer.Actions!Warp.Installer.Actions.CustomActions.ReadCmdLineParams
        3⤵
        • Loads dropped DLL
        PID:3068
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI8C9B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240880781 115 Warp.Installer.Actions!Warp.Installer.Actions.CustomActions.PrepareForUpgrade
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        PID:1560
        • C:\Windows\system32\sc.exe
          "sc.exe" failure CloudflareWARP reset= 0 actions= /////
          4⤵
          • Launches sc.exe
          PID:2904
        • C:\Windows\system32\sc.exe
          "sc.exe" failureflag CloudflareWARP 0
          4⤵
          • Launches sc.exe
          PID:2340
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSI95D3.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240883140 127 Warp.Installer.Actions!Warp.Installer.Actions.CustomActions.InstallService
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:804
        • C:\Windows\system32\sc.exe
          "sc.exe" failure CloudflareWARP reset= 86400 actions= restart/0/restart/1000/restart/5000
          4⤵
          • Launches sc.exe
          PID:5736
        • C:\Windows\system32\sc.exe
          "sc.exe" failureflag CloudflareWARP 1
          4⤵
          • Launches sc.exe
          PID:2968
        • C:\Windows\system32\sc.exe
          "sc.exe" config CloudflareWARP binPath= "\"C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe"\"
          4⤵
          • Network Service Discovery
          • Launches sc.exe
          PID:5280
        • C:\Windows\system32\sc.exe
          "sc.exe" config CloudflareWARP start=AUTO
          4⤵
          • Launches sc.exe
          PID:4668
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 207E13E31B38BDCDFACC05CFB1B3C948 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:3020
    • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
      "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      PID:5016
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding C9DF9F7B213426767BA76CEDF4B01559
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:3312
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding 7ED0E0DA4B83D5231BC300F3DB9F1594 E Global\MSI0000
      2⤵
      • Loads dropped DLL
      PID:5696
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIAE46.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241086046 185 Warp.Installer.Actions!Warp.Installer.Actions.CustomActions.ReadCmdLineParams
        3⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        PID:3696
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIAF12.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241086218 197 Warp.Installer.Actions!Warp.Installer.Actions.CustomActions.UninstallService
        3⤵
        • Drops file in Windows directory
        • Suspicious behavior: EnumeratesProcesses
        PID:4244
        • C:\Windows\system32\sc.exe
          "sc.exe" config CloudflareWARP start=AUTO
          4⤵
          • Launches sc.exe
          PID:3036
      • C:\Windows\system32\rundll32.exe
        rundll32.exe "C:\Windows\Installer\MSIAFED.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241086437 209 Warp.Installer.Actions!Warp.Installer.Actions.CustomActions.DeleteInstalledDirectories
        3⤵
        • Drops file in Windows directory
        PID:5000
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 4C9F492819F7E06964279D972FF5E57D E Global\MSI0000
      2⤵
      • System Location Discovery: System Language Discovery
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      PID:4048
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B395911EA2CC93D590A7A93556BD1207
      2⤵
      • System Location Discovery: System Language Discovery
      PID:6748
    • C:\Windows\System32\MsiExec.exe
      C:\Windows\System32\MsiExec.exe -Embedding C31CEA66D79BCEBD7F70D9D32146665A E Global\MSI0000
      2⤵
        PID:6536
        • C:\Windows\system32\rundll32.exe
          rundll32.exe "C:\Windows\Installer\MSI9C62.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241212531 246 Warp.Installer.Actions!Warp.Installer.Actions.CustomActions.ReadCmdLineParams
          3⤵
            PID:6316
          • C:\Windows\system32\rundll32.exe
            rundll32.exe "C:\Windows\Installer\MSIA2DB.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_241214140 257 Warp.Installer.Actions!Warp.Installer.Actions.CustomActions.InstallService
            3⤵
            • Drops file in Windows directory
            PID:6644
            • C:\Windows\system32\sc.exe
              "sc.exe" failure CloudflareWARP reset= 86400 actions= restart/0/restart/1000/restart/5000
              4⤵
              • Launches sc.exe
              PID:6996
            • C:\Windows\system32\sc.exe
              "sc.exe" failureflag CloudflareWARP 1
              4⤵
              • Launches sc.exe
              PID:6152
            • C:\Windows\system32\sc.exe
              "sc.exe" config CloudflareWARP binPath= "\"C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe"\"
              4⤵
              • Network Service Discovery
              • Launches sc.exe
              PID:5980
            • C:\Windows\system32\sc.exe
              "sc.exe" config CloudflareWARP start=AUTO
              4⤵
              • Launches sc.exe
              PID:8052
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding B448CFEE014B735E0141ED63AB27E926 E Global\MSI0000
          2⤵
          • System Location Discovery: System Language Discovery
          • Modifies data under HKEY_USERS
          PID:7704
        • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
          "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:5904
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:5624
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:388
        • C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe
          "C:\Program Files\Cloudflare\Cloudflare WARP\warp-svc.exe"
          1⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Network Service Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:5800
        • C:\PROGRA~1\CLOUDF~1\CLOUDF~1\Cloudflare WARP.exe
          C:\PROGRA~1\CLOUDF~1\CLOUDF~1\CLOUDF~1.EXE
          1⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:3444
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
          1⤵
            PID:5516
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe"
            1⤵
            • Enumerates system info in registry
            • Modifies data under HKEY_USERS
            • Modifies registry class
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            • Suspicious use of WriteProcessMemory
            PID:3300
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd52dec728,0x7ffd52dec734,0x7ffd52dec740
              2⤵
                PID:5576
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1456,i,7759921889411804773,8476957855263182476,524288 --field-trial-handle=1972,i,6731893935612381685,1933496449290857013,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=2000 /prefetch:11
                2⤵
                • System Time Discovery
                PID:3900
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,2192727673297082238,7217677843847374801,262144 --field-trial-handle=1972,i,6731893935612381685,1933496449290857013,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1968 /prefetch:2
                2⤵
                  PID:4508
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,11727498454892423524,15672226316168722904,524288 --field-trial-handle=1972,i,6731893935612381685,1933496449290857013,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=1780 /prefetch:13
                  2⤵
                    PID:5260
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3260,i,18381152341781315303,1737121762007565400,2097152 --field-trial-handle=1972,i,6731893935612381685,1933496449290857013,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3268 /prefetch:1
                    2⤵
                      PID:3012
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3300,i,13146742429064799829,6303779789381249106,2097152 --field-trial-handle=1972,i,6731893935612381685,1933496449290857013,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3308 /prefetch:1
                      2⤵
                        PID:2556
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4244,i,687544718999357725,13567320599076086882,2097152 --field-trial-handle=1972,i,6731893935612381685,1933496449290857013,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4264 /prefetch:9
                        2⤵
                          PID:2960
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4640,i,14249390733418141801,7239092745113374933,2097152 --field-trial-handle=1972,i,6731893935612381685,1933496449290857013,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4656 /prefetch:1
                          2⤵
                            PID:2856
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5448,i,10491500315114256524,8302129502413044709,524288 --field-trial-handle=1972,i,6731893935612381685,1933496449290857013,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5364 /prefetch:14
                            2⤵
                              PID:6036
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,5298729227444266444,12796134987251751524,524288 --field-trial-handle=1972,i,6731893935612381685,1933496449290857013,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5760 /prefetch:14
                              2⤵
                                PID:3264
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,13757622328963270366,14091576443983198030,524288 --field-trial-handle=1972,i,6731893935612381685,1933496449290857013,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5456 /prefetch:14
                                2⤵
                                  PID:3208
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5840,i,5007666073184734207,17572982205851522851,524288 --field-trial-handle=1972,i,6731893935612381685,1933496449290857013,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5860 /prefetch:14
                                  2⤵
                                    PID:5636
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5944,i,7422796827159363876,8597046339181366563,2097152 --field-trial-handle=1972,i,6731893935612381685,1933496449290857013,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=5724 /prefetch:1
                                    2⤵
                                      PID:4780
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5500,i,580079361071630937,2230429599703439322,2097152 --field-trial-handle=1972,i,6731893935612381685,1933496449290857013,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=4776 /prefetch:1
                                      2⤵
                                        PID:3952
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=3400,i,4942293823909108142,141993193833360722,2097152 --field-trial-handle=1972,i,6731893935612381685,1933496449290857013,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3332 /prefetch:1
                                        2⤵
                                          PID:6100
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --metrics-shmem-handle=3480,i,8638024649879610157,14784934257474484782,2097152 --field-trial-handle=1972,i,6731893935612381685,1933496449290857013,262144 --variations-seed-version=20260129-170056.646000 --mojo-platform-channel-handle=3468 /prefetch:1
                                          2⤵
                                            PID:5488
                                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                          1⤵
                                            PID:5416
                                          • C:\Windows\system32\svchost.exe
                                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                            1⤵
                                              PID:5524
                                            • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
                                              "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • Loads dropped DLL
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:5236
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe"
                                              1⤵
                                              • Drops file in Windows directory
                                              • Enumerates system info in registry
                                              • Modifies data under HKEY_USERS
                                              • Modifies registry class
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                              • Suspicious use of SendNotifyMessage
                                              • Suspicious use of WriteProcessMemory
                                              PID:5668
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd52dec728,0x7ffd52dec734,0x7ffd52dec740
                                                2⤵
                                                  PID:748
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1796,i,8750584927982511162,16636330408989257004,524288 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=2116 /prefetch:11
                                                  2⤵
                                                  • System Time Discovery
                                                  PID:5648
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1620,i,18274362932440235970,7565889411955855200,262144 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=2084 /prefetch:2
                                                  2⤵
                                                    PID:5160
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,13617366670961770238,12887408731378205322,524288 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=2388 /prefetch:13
                                                    2⤵
                                                      PID:776
                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3228,i,13481750061954283748,11813360484023585363,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=3252 /prefetch:1
                                                      2⤵
                                                        PID:4132
                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3284,i,4315261270809992187,14139133892121671401,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=3312 /prefetch:1
                                                        2⤵
                                                          PID:4804
                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4472,i,11703890257921541172,15740208426800605275,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=4480 /prefetch:1
                                                          2⤵
                                                            PID:2500
                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5232,i,86976582541634219,4890136876169209399,524288 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=5244 /prefetch:14
                                                            2⤵
                                                              PID:412
                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=5488,i,16685869775723758320,57046918456899110,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=5296 /prefetch:1
                                                              2⤵
                                                                PID:3776
                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=5620,i,14985819822023333987,9508863195442953936,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=5496 /prefetch:1
                                                                2⤵
                                                                  PID:3580
                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --metrics-shmem-handle=3316,i,9675165375940383952,11552685479347033184,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=3528 /prefetch:1
                                                                  2⤵
                                                                    PID:4680
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,10359337443470540866,10385083315693943606,524288 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=3392 /prefetch:14
                                                                    2⤵
                                                                    • NTFS ADS
                                                                    PID:5468
                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5660,i,8154474464316736333,6105107214647201214,524288 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=5720 /prefetch:14
                                                                    2⤵
                                                                      PID:3188
                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5620,i,9066823929855326614,8358463547266644206,524288 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=3444 /prefetch:14
                                                                      2⤵
                                                                        PID:5356
                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,2453110359482934261,2517566844726548591,524288 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=5456 /prefetch:14
                                                                        2⤵
                                                                          PID:3988
                                                                        • C:\Windows\System32\msiexec.exe
                                                                          "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\Cloudflare_WARP_2026.3.851.0.msi"
                                                                          2⤵
                                                                          • Enumerates connected drives
                                                                          • Drops file in Program Files directory
                                                                          PID:3316
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3560,i,15244737541900419342,13517622765997439227,262144 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=5496 /prefetch:10
                                                                          2⤵
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          PID:1368
                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --metrics-shmem-handle=3188,i,18145757095133924760,624065595786760889,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=872 /prefetch:1
                                                                          2⤵
                                                                            PID:5644
                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=3196,i,12290260874794134913,1127527255521843578,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=2344 /prefetch:1
                                                                            2⤵
                                                                              PID:4512
                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=6464,i,16208108928808745928,2753625412717335802,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=6444 /prefetch:1
                                                                              2⤵
                                                                                PID:3336
                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --metrics-shmem-handle=4364,i,12281758832796922874,6723569419124126172,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=5600 /prefetch:1
                                                                                2⤵
                                                                                  PID:5988
                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --metrics-shmem-handle=3504,i,1922689571588736512,1768244103019011995,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=4540 /prefetch:1
                                                                                  2⤵
                                                                                    PID:3968
                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --metrics-shmem-handle=6724,i,8835467938597143712,1066816102951015538,524288 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=6684 /prefetch:12
                                                                                    2⤵
                                                                                      PID:6124
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6736,i,18119604855097457269,18385868356819329495,524288 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=6740 /prefetch:14
                                                                                      2⤵
                                                                                      • Modifies registry class
                                                                                      PID:3456
                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=6832,i,6672544449501727023,5874187203812203807,524288 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=6844 /prefetch:14
                                                                                      2⤵
                                                                                        PID:1680
                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=6416,i,6920440484188189044,7682216665710323673,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=6520 /prefetch:1
                                                                                        2⤵
                                                                                          PID:3464
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=6644,i,600150074545760175,2795243407749509308,524288 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=6632 /prefetch:14
                                                                                          2⤵
                                                                                          • NTFS ADS
                                                                                          PID:2428
                                                                                        • C:\Windows\System32\msiexec.exe
                                                                                          "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\Cloudflare_WARP_2026.3.851.0 (1).msi"
                                                                                          2⤵
                                                                                          • Enumerates connected drives
                                                                                          • Drops file in Program Files directory
                                                                                          PID:2840
                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=3436,i,14702774976115993269,16290769361090816176,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=6452 /prefetch:1
                                                                                          2⤵
                                                                                            PID:2132
                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=6184,i,952276784922522575,9034572971694818025,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=876 /prefetch:1
                                                                                            2⤵
                                                                                              PID:1208
                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --metrics-shmem-handle=7040,i,3981539451373122538,17499506796239019663,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=7024 /prefetch:1
                                                                                              2⤵
                                                                                                PID:6368
                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --metrics-shmem-handle=2344,i,2460482133896458716,4617728923734887156,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=6784 /prefetch:1
                                                                                                2⤵
                                                                                                  PID:6892
                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --metrics-shmem-handle=3372,i,7654392954877945323,3800921404703527597,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=6624 /prefetch:1
                                                                                                  2⤵
                                                                                                    PID:5096
                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --metrics-shmem-handle=7228,i,12241181163006808885,15788873566573142454,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=7208 /prefetch:1
                                                                                                    2⤵
                                                                                                      PID:4508
                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --metrics-shmem-handle=7352,i,1674687753826030188,16308274519951192418,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=7356 /prefetch:1
                                                                                                      2⤵
                                                                                                        PID:5184
                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --metrics-shmem-handle=7556,i,11106061865624142620,17565737313024988363,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=7336 /prefetch:1
                                                                                                        2⤵
                                                                                                          PID:7040
                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --metrics-shmem-handle=7684,i,11574321390067489401,16486883535854577115,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=7668 /prefetch:1
                                                                                                          2⤵
                                                                                                            PID:3684
                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --metrics-shmem-handle=7832,i,10085505480129846235,3412675935637199187,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=7828 /prefetch:1
                                                                                                            2⤵
                                                                                                              PID:4812
                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --metrics-shmem-handle=7964,i,12248319542909847756,12366091580915199539,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=7960 /prefetch:1
                                                                                                              2⤵
                                                                                                                PID:3944
                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --metrics-shmem-handle=8112,i,8337866475705888484,15709808864055245046,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=8100 /prefetch:1
                                                                                                                2⤵
                                                                                                                  PID:4656
                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --metrics-shmem-handle=8284,i,3007796786967044410,11867633184422038682,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=8280 /prefetch:1
                                                                                                                  2⤵
                                                                                                                    PID:1124
                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --metrics-shmem-handle=8480,i,12776662249250648200,1798352374855486697,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=8264 /prefetch:1
                                                                                                                    2⤵
                                                                                                                      PID:5396
                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --metrics-shmem-handle=8676,i,9998696700143541055,8395586632806700932,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=8268 /prefetch:1
                                                                                                                      2⤵
                                                                                                                        PID:2976
                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --metrics-shmem-handle=8808,i,6419796084615885866,9635580139113675044,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=8800 /prefetch:1
                                                                                                                        2⤵
                                                                                                                          PID:5940
                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --metrics-shmem-handle=8948,i,11485365583708042470,11558479210917806847,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=8976 /prefetch:1
                                                                                                                          2⤵
                                                                                                                            PID:4448
                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --metrics-shmem-handle=8968,i,6301053074784815661,16798944209933405457,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=9108 /prefetch:1
                                                                                                                            2⤵
                                                                                                                              PID:4936
                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --metrics-shmem-handle=9256,i,2230456829191846147,15419406212967046243,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=9272 /prefetch:1
                                                                                                                              2⤵
                                                                                                                                PID:5400
                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --metrics-shmem-handle=9412,i,15437491866671501923,14596197559440965755,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=9416 /prefetch:1
                                                                                                                                2⤵
                                                                                                                                  PID:1292
                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --metrics-shmem-handle=9552,i,10449236151117360075,6599117129045807391,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=9564 /prefetch:1
                                                                                                                                  2⤵
                                                                                                                                    PID:2456
                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --metrics-shmem-handle=9720,i,2096484191575472150,11195260771677954810,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=9732 /prefetch:1
                                                                                                                                    2⤵
                                                                                                                                      PID:6348
                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --metrics-shmem-handle=9864,i,2309557157969373012,5839236398141078559,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=9868 /prefetch:1
                                                                                                                                      2⤵
                                                                                                                                        PID:6344
                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --metrics-shmem-handle=10016,i,17172310717134499615,7588583242247336893,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=10020 /prefetch:1
                                                                                                                                        2⤵
                                                                                                                                          PID:5924
                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --metrics-shmem-handle=10172,i,13355207033474346828,11935339996669341757,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=9412 /prefetch:1
                                                                                                                                          2⤵
                                                                                                                                            PID:784
                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --metrics-shmem-handle=10176,i,14066377536274568034,5710614767329843047,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=10292 /prefetch:1
                                                                                                                                            2⤵
                                                                                                                                              PID:6896
                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --metrics-shmem-handle=10444,i,4716227792921737897,2563708205805588444,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=10300 /prefetch:1
                                                                                                                                              2⤵
                                                                                                                                                PID:7048
                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --metrics-shmem-handle=10468,i,16974681808200631538,8893600427377295163,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=10596 /prefetch:1
                                                                                                                                                2⤵
                                                                                                                                                  PID:7024
                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --metrics-shmem-handle=10744,i,15636857736362493241,17061513657013482079,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=10708 /prefetch:1
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2840
                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --metrics-shmem-handle=10872,i,17261371489331116488,3236549434902516507,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=10884 /prefetch:1
                                                                                                                                                    2⤵
                                                                                                                                                      PID:7016
                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --metrics-shmem-handle=11036,i,2725252279756736447,10544678170871929253,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=10892 /prefetch:1
                                                                                                                                                      2⤵
                                                                                                                                                        PID:7104
                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --metrics-shmem-handle=11184,i,16885751470551179712,5252411485169291582,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=11040 /prefetch:1
                                                                                                                                                        2⤵
                                                                                                                                                          PID:3760
                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --metrics-shmem-handle=11320,i,4163750411050730512,7471278239469906293,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=11340 /prefetch:1
                                                                                                                                                          2⤵
                                                                                                                                                            PID:1068
                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --metrics-shmem-handle=11316,i,1932271607828330205,9369787301202951066,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=11484 /prefetch:1
                                                                                                                                                            2⤵
                                                                                                                                                              PID:5488
                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --metrics-shmem-handle=11624,i,3839515921056060724,15252953326789586810,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=11628 /prefetch:1
                                                                                                                                                              2⤵
                                                                                                                                                                PID:6420
                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --metrics-shmem-handle=11764,i,13934755536027667323,9950659596586878896,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=11780 /prefetch:1
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:6784
                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --metrics-shmem-handle=11912,i,6704792413670587415,12850970666430182600,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=11924 /prefetch:1
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:6680
                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --metrics-shmem-handle=12068,i,6934347673349137457,2639364125704563202,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=12076 /prefetch:1
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:6772
                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --metrics-shmem-handle=12096,i,12849534609889325675,9200831632741168270,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=12224 /prefetch:1
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:6700
                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --metrics-shmem-handle=12360,i,2961224550518748341,18310200783975223834,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=12364 /prefetch:1
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:6668
                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --metrics-shmem-handle=12520,i,14647213653181273360,9601225240896437443,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=12396 /prefetch:1
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:6660
                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --metrics-shmem-handle=12656,i,5987602329483197156,1638909002827939904,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=12660 /prefetch:1
                                                                                                                                                                            2⤵
                                                                                                                                                                              PID:6656
                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --metrics-shmem-handle=12820,i,14209538402012458378,5802220317304744942,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=12788 /prefetch:1
                                                                                                                                                                              2⤵
                                                                                                                                                                                PID:6804
                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --metrics-shmem-handle=12952,i,11846536566421888551,15180517839126503339,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=12968 /prefetch:1
                                                                                                                                                                                2⤵
                                                                                                                                                                                  PID:6512
                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --metrics-shmem-handle=13100,i,6083656180285283237,13298762369577262031,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=13112 /prefetch:1
                                                                                                                                                                                  2⤵
                                                                                                                                                                                    PID:4240
                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --metrics-shmem-handle=13252,i,13561662330505173720,16463602819363673497,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=13260 /prefetch:1
                                                                                                                                                                                    2⤵
                                                                                                                                                                                      PID:5364
                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --metrics-shmem-handle=13400,i,14295315064457467773,1987184915507459879,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=13412 /prefetch:1
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:6684
                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --metrics-shmem-handle=13548,i,5287564553013321673,13790948005791869792,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=13552 /prefetch:1
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:6612
                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --metrics-shmem-handle=13696,i,1148758851554262868,13248561788757613321,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=13712 /prefetch:1
                                                                                                                                                                                          2⤵
                                                                                                                                                                                            PID:6628
                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --metrics-shmem-handle=13844,i,12582544153828261326,6609210938067581219,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=13860 /prefetch:1
                                                                                                                                                                                            2⤵
                                                                                                                                                                                              PID:6616
                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --metrics-shmem-handle=14012,i,7216271922036649820,6371703347638480555,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=14016 /prefetch:1
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:6508
                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --metrics-shmem-handle=14140,i,9905547915522227871,4846629253584529686,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=14156 /prefetch:1
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:6636
                                                                                                                                                                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --metrics-shmem-handle=14288,i,18432978549163688952,15573646136697626341,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=14304 /prefetch:1
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:6552
                                                                                                                                                                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --metrics-shmem-handle=14440,i,15466049353676599032,2709636220882891313,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=14456 /prefetch:1
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:6572
                                                                                                                                                                                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --metrics-shmem-handle=14588,i,743845817837407501,2458109464295213649,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=14592 /prefetch:1
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:6716
                                                                                                                                                                                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --metrics-shmem-handle=14736,i,3147489047479874239,15014367799849913744,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=14752 /prefetch:1
                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                          PID:6580
                                                                                                                                                                                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --metrics-shmem-handle=14884,i,12339806954220443615,6362128475828818244,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=14900 /prefetch:1
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                            PID:6768
                                                                                                                                                                                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --metrics-shmem-handle=15032,i,16599552185007703087,6304565831738923182,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=15048 /prefetch:1
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:6272
                                                                                                                                                                                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --metrics-shmem-handle=15504,i,6699902018711984540,6370840101425323988,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=14924 /prefetch:1
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:8068
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=87 --metrics-shmem-handle=15788,i,15096295318478996406,213754055106061918,2097152 --field-trial-handle=2088,i,8595913723876215797,1319050931250990284,262144 --variations-seed-version=20260501-170044.037000-production --mojo-platform-channel-handle=14776 /prefetch:1
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:8236
                                                                                                                                                                                                              • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                                                                                                                                                                                                                "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:5920
                                                                                                                                                                                                                • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
                                                                                                                                                                                                                  "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                  PID:2956
                                                                                                                                                                                                                • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
                                                                                                                                                                                                                  "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                  • Loads dropped DLL
                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                  PID:6136
                                                                                                                                                                                                                • C:\Program Files\VideoLAN\VLC\vlc.exe
                                                                                                                                                                                                                  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Music\CheckpointEnable.rm"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                  • Suspicious behavior: AddClipboardFormatListener
                                                                                                                                                                                                                  • Suspicious behavior: GetForegroundWindowSpam
                                                                                                                                                                                                                  • Suspicious use of SendNotifyMessage
                                                                                                                                                                                                                  • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                  PID:6040
                                                                                                                                                                                                                • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                  "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:3968
                                                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                      "C:\Program Files\Mozilla Firefox\firefox.exe"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Checks processor information in registry
                                                                                                                                                                                                                      • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                      PID:1992
                                                                                                                                                                                                                      • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 1936 -initialChannelId {84b168ff-df74-4b46-8318-7aa830bf5894} -parentPid 1992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1992" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:5080
                                                                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2408 -prefsLen 27133 -prefMapHandle 2412 -prefMapSize 270279 -ipcHandle 2420 -initialChannelId {fd0cd376-aca2-43d8-9af9-20b33a70f6fb} -parentPid 1992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                          PID:3468
                                                                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3768 -prefsLen 27274 -prefMapHandle 3772 -prefMapSize 270279 -jsInitHandle 3776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3784 -initialChannelId {f082b4a0-bd1f-4639-9f03-1ecb29ba647f} -parentPid 1992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                          • Checks processor information in registry
                                                                                                                                                                                                                          PID:5676
                                                                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3920 -prefsLen 27274 -prefMapHandle 3924 -prefMapSize 270279 -ipcHandle 3940 -initialChannelId {cb4cfc8e-4093-4a0f-a362-4f1661822708} -parentPid 1992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1992" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:3964
                                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2812 -prefsLen 34773 -prefMapHandle 2816 -prefMapSize 270279 -jsInitHandle 4528 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3184 -initialChannelId {f5dc0b72-f017-481d-bc47-aae46bd36af0} -parentPid 1992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                            PID:2732
                                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4952 -prefsLen 34822 -prefMapHandle 4956 -prefMapSize 270279 -ipcHandle 4964 -initialChannelId {adba3e3b-4c7d-4655-9ebb-d2ee7870372a} -parentPid 1992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                            PID:1544
                                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5388 -prefsLen 32952 -prefMapHandle 5396 -prefMapSize 270279 -jsInitHandle 5400 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5408 -initialChannelId {82007862-f22d-4701-952c-d6e31fa879d2} -parentPid 1992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                            PID:6408
                                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5580 -prefsLen 32952 -prefMapHandle 5584 -prefMapSize 270279 -jsInitHandle 5588 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5596 -initialChannelId {5e318628-906b-4dd1-aff7-fb3d8c664258} -parentPid 1992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                            PID:6416
                                                                                                                                                                                                                          • C:\Program Files\Mozilla Firefox\firefox.exe
                                                                                                                                                                                                                            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5768 -prefsLen 32952 -prefMapHandle 5772 -prefMapSize 270279 -jsInitHandle 5776 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5784 -initialChannelId {63b8d5b1-572d-46fb-a459-63dc3a782c75} -parentPid 1992 -crashReporter "\\.\pipe\gecko-crash-server-pipe.1992" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Checks processor information in registry
                                                                                                                                                                                                                            PID:6424
                                                                                                                                                                                                                      • C:\Windows\System32\oobe\UserOOBEBroker.exe
                                                                                                                                                                                                                        C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • Drops file in Windows directory
                                                                                                                                                                                                                        PID:8984
                                                                                                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                                                                                                                                                                                                        C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                        • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                        PID:9056
                                                                                                                                                                                                                      • C:\Windows\System32\svchost.exe
                                                                                                                                                                                                                        C:\Windows\System32\svchost.exe -k UnistackSvcGroup
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:9152
                                                                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
                                                                                                                                                                                                                          C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                                                                                                                                          PID:6928
                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://go.microsoft.com/fwlink/?linkid=2157517
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                          • Enumerates system info in registry
                                                                                                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                                                                                                          • Modifies registry class
                                                                                                                                                                                                                          PID:8556
                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2fc,0x300,0x304,0x2f8,0x30c,0x7ffd4f7ec188,0x7ffd4f7ec194,0x7ffd4f7ec1a0
                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                              PID:8584
                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1960,i,13248126499971497880,1787353864549543453,262144 --field-trial-handle=2036,i,3711293797660936634,13705983634573295512,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                PID:8764
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,1496530969801246142,566253354389654374,524288 --field-trial-handle=2036,i,3711293797660936634,13705983634573295512,262144 --variations-seed-version --mojo-platform-channel-handle=1480 /prefetch:11
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                • System Time Discovery
                                                                                                                                                                                                                                PID:4900
                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,3585047214211329372,13483281719414498400,524288 --field-trial-handle=2036,i,3711293797660936634,13705983634573295512,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:13
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:8840
                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,16293605486680664297,5832798013182962425,2097152 --field-trial-handle=2036,i,3711293797660936634,13705983634573295512,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:5056
                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3592,i,15285381415362389156,3915204681282426914,2097152 --field-trial-handle=2036,i,3711293797660936634,13705983634573295512,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                      PID:5228
                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4928,i,10371220584521646982,5056122406534640362,2097152 --field-trial-handle=2036,i,3711293797660936634,13705983634573295512,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                        PID:4920
                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3964,i,13720436849878678707,2330966611993191746,2097152 --field-trial-handle=2036,i,3711293797660936634,13705983634573295512,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                          PID:6620
                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5124,i,11678800342688058548,3408338912700121760,2097152 --field-trial-handle=2036,i,3711293797660936634,13705983634573295512,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:7556
                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,8308194523748390607,12912814064114970101,524288 --field-trial-handle=2036,i,3711293797660936634,13705983634573295512,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:14
                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                              PID:7944
                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,14118385106874058496,14768940401059515474,524288 --field-trial-handle=2036,i,3711293797660936634,13705983634573295512,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:14
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:7552
                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,10804381705908248989,12583125415363274594,524288 --field-trial-handle=2036,i,3711293797660936634,13705983634573295512,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:7444
                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,10804381705908248989,12583125415363274594,524288 --field-trial-handle=2036,i,3711293797660936634,13705983634573295512,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:14
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:7864
                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,14997209335496741265,14598555210188232282,524288 --field-trial-handle=2036,i,3711293797660936634,13705983634573295512,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:14
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                      PID:7976
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                                                                                                                                                                                                                                        cookie_exporter.exe --cookie-json=1140
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:8012
                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                        • Enumerates system info in registry
                                                                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                        • Modifies registry class
                                                                                                                                                                                                                                                        PID:7472
                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b8,0x7ffd4f7ec188,0x7ffd4f7ec194,0x7ffd4f7ec1a0
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:7204
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1708,i,3147951271391139810,2854370395817819332,524288 --field-trial-handle=2020,i,11455900273826098735,15576792045539088124,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:11
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                            • System Time Discovery
                                                                                                                                                                                                                                                            PID:6392
                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,4157691044979890133,3573667225625594206,262144 --field-trial-handle=2020,i,11455900273826098735,15576792045539088124,262144 --variations-seed-version --mojo-platform-channel-handle=2016 /prefetch:2
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:6436
                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,6315275847063861460,9293533494012129043,524288 --field-trial-handle=2020,i,11455900273826098735,15576792045539088124,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:13
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:8220
                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,15565648899920832009,6349780390531437311,524288 --field-trial-handle=2020,i,11455900273826098735,15576792045539088124,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:460
                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,15565648899920832009,6349780390531437311,524288 --field-trial-handle=2020,i,11455900273826098735,15576792045539088124,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:14
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:5080
                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4900,i,12275550372128818010,12578805056807489948,2097152 --field-trial-handle=2020,i,11455900273826098735,15576792045539088124,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:6508
                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=4904,i,6516706452455379544,8820473820016424604,2097152 --field-trial-handle=2020,i,11455900273826098735,15576792045539088124,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:6512
                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,17489741785607323146,4463554979321759432,524288 --field-trial-handle=2020,i,11455900273826098735,15576792045539088124,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:6684
                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,13923149517824987895,3167211159407392757,524288 --field-trial-handle=2020,i,11455900273826098735,15576792045539088124,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:14
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:8068
                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                                                                                            • Enumerates system info in registry
                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                            • Modifies registry class
                                                                                                                                                                                                                                                                            PID:2944
                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffd4f7ec188,0x7ffd4f7ec194,0x7ffd4f7ec1a0
                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                PID:8640
                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1608,i,2468704752559114924,10500893854129858672,262144 --field-trial-handle=2376,i,8605604082871359430,12171172222841827947,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:2
                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                  PID:2836
                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,8244502584476673897,10815189878424773770,524288 --field-trial-handle=2376,i,8605604082871359430,12171172222841827947,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:11
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                  • System Time Discovery
                                                                                                                                                                                                                                                                                  PID:4712
                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,11645827837404011063,7443800577708103300,524288 --field-trial-handle=2376,i,8605604082871359430,12171172222841827947,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:13
                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                    PID:1444
                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4120,i,2964757722019502103,5893805948016715477,524288 --field-trial-handle=2376,i,8605604082871359430,12171172222841827947,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                      PID:8532
                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4120,i,2964757722019502103,5893805948016715477,524288 --field-trial-handle=2376,i,8605604082871359430,12171172222841827947,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:14
                                                                                                                                                                                                                                                                                      4⤵
                                                                                                                                                                                                                                                                                        PID:7112
                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,10199736465007373320,15349692832226706122,524288 --field-trial-handle=2376,i,8605604082871359430,12171172222841827947,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
                                                                                                                                                                                                                                                                                        4⤵
                                                                                                                                                                                                                                                                                          PID:6080
                                                                                                                                                                                                                                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4792,i,16493969577161742496,2509690405569076802,524288 --field-trial-handle=2376,i,8605604082871359430,12171172222841827947,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
                                                                                                                                                                                                                                                                                          4⤵
                                                                                                                                                                                                                                                                                            PID:6840
                                                                                                                                                                                                                                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,6770925160592453957,2751252541359330636,524288 --field-trial-handle=2376,i,8605604082871359430,12171172222841827947,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:14
                                                                                                                                                                                                                                                                                            4⤵
                                                                                                                                                                                                                                                                                              PID:1736
                                                                                                                                                                                                                                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,13309425415635730634,6540896390923063853,524288 --field-trial-handle=2376,i,8605604082871359430,12171172222841827947,262144 --variations-seed-version --mojo-platform-channel-handle=3300 /prefetch:14
                                                                                                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                                                                                                PID:5348
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3312,i,7047049179114225269,2822981781110235906,524288 --field-trial-handle=2376,i,8605604082871359430,12171172222841827947,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
                                                                                                                                                                                                                                                                                                4⤵
                                                                                                                                                                                                                                                                                                  PID:9064
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,4354966382498580799,5251666454338901696,524288 --field-trial-handle=2376,i,8605604082871359430,12171172222841827947,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
                                                                                                                                                                                                                                                                                                  4⤵
                                                                                                                                                                                                                                                                                                    PID:9196
                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,5011853849439839269,5062232595930597110,524288 --field-trial-handle=2376,i,8605604082871359430,12171172222841827947,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
                                                                                                                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                                                                                                                      PID:6460
                                                                                                                                                                                                                                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:4672
                                                                                                                                                                                                                                                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:3952
                                                                                                                                                                                                                                                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                      PID:2984
                                                                                                                                                                                                                                                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                                                                                                                                                                                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\Downloads\FormatOptimize.xhtml
                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                        PID:7104
                                                                                                                                                                                                                                                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                                                                                                                                                                                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:1884
                                                                                                                                                                                                                                                                                                        • C:\Windows\System32\msiexec.exe
                                                                                                                                                                                                                                                                                                          "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\Cloudflare_WARP_2026.3.851.0 (1).msi"
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                          • Enumerates connected drives
                                                                                                                                                                                                                                                                                                          PID:2120
                                                                                                                                                                                                                                                                                                        • C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                          C:\Windows\system32\vssvc.exe
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:2556
                                                                                                                                                                                                                                                                                                          • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                                                                                                            PID:7936
                                                                                                                                                                                                                                                                                                          • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:764
                                                                                                                                                                                                                                                                                                          • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:8688
                                                                                                                                                                                                                                                                                                          • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:1276
                                                                                                                                                                                                                                                                                                          • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:2208
                                                                                                                                                                                                                                                                                                          • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:4444
                                                                                                                                                                                                                                                                                                          • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:7764
                                                                                                                                                                                                                                                                                                          • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:9024
                                                                                                                                                                                                                                                                                                          • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:5192
                                                                                                                                                                                                                                                                                                          • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:8156
                                                                                                                                                                                                                                                                                                          • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:7788
                                                                                                                                                                                                                                                                                                          • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:9120
                                                                                                                                                                                                                                                                                                          • C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files\Cloudflare\Cloudflare WARP\Cloudflare WARP.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                            • Executes dropped EXE
                                                                                                                                                                                                                                                                                                            PID:6992
                                                                                                                                                                                                                                                                                                          • C:\Program Files\dotnet\dotnet.exe
                                                                                                                                                                                                                                                                                                            "C:\Program Files\dotnet\dotnet.exe"
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:2484
                                                                                                                                                                                                                                                                                                            • C:\Program Files\dotnet\dotnet.exe
                                                                                                                                                                                                                                                                                                              "C:\Program Files\dotnet\dotnet.exe"
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:8700
                                                                                                                                                                                                                                                                                                              • C:\Program Files\dotnet\dotnet.exe
                                                                                                                                                                                                                                                                                                                "C:\Program Files\dotnet\dotnet.exe"
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:7196
                                                                                                                                                                                                                                                                                                                • C:\Program Files\dotnet\dotnet.exe
                                                                                                                                                                                                                                                                                                                  "C:\Program Files\dotnet\dotnet.exe"
                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                    PID:4640
                                                                                                                                                                                                                                                                                                                  • C:\Program Files\dotnet\dotnet.exe
                                                                                                                                                                                                                                                                                                                    "C:\Program Files\dotnet\dotnet.exe"
                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                      PID:4748
                                                                                                                                                                                                                                                                                                                    • C:\Program Files\dotnet\dotnet.exe
                                                                                                                                                                                                                                                                                                                      "C:\Program Files\dotnet\dotnet.exe"
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:3964
                                                                                                                                                                                                                                                                                                                      • C:\Program Files\dotnet\dotnet.exe
                                                                                                                                                                                                                                                                                                                        "C:\Program Files\dotnet\dotnet.exe"
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:8580
                                                                                                                                                                                                                                                                                                                        • C:\Program Files\dotnet\dotnet.exe
                                                                                                                                                                                                                                                                                                                          "C:\Program Files\dotnet\dotnet.exe"
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:7436
                                                                                                                                                                                                                                                                                                                          • C:\Windows\system32\LogonUI.exe
                                                                                                                                                                                                                                                                                                                            "LogonUI.exe" /flags:0x4 /state0:0xa3907855 /state1:0x41c64e6d
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                                                                                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                                                                                                                                                                                                            PID:7440
                                                                                                                                                                                                                                                                                                                          • C:\Windows\System32\rundll32.exe
                                                                                                                                                                                                                                                                                                                            C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:6624

                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                                                                                                                                  System Services

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1569

                                                                                                                                                                                                                                                                                                                                  Service Execution

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1569.002

                                                                                                                                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                                                                                  Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1546

                                                                                                                                                                                                                                                                                                                                  Installer Packages

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1546.016

                                                                                                                                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                                                                                  Windows Service

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1543.003

                                                                                                                                                                                                                                                                                                                                  Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1546

                                                                                                                                                                                                                                                                                                                                  Installer Packages

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1546.016

                                                                                                                                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                                                                                                                                  System Binary Proxy Execution

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1218

                                                                                                                                                                                                                                                                                                                                  Msiexec

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1218.007

                                                                                                                                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                                                                                                                                  Browser Information Discovery

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1217

                                                                                                                                                                                                                                                                                                                                  Network Service Discovery

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1046

                                                                                                                                                                                                                                                                                                                                  Peripheral Device Discovery

                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                  T1120

                                                                                                                                                                                                                                                                                                                                  Query Registry

                                                                                                                                                                                                                                                                                                                                  5
                                                                                                                                                                                                                                                                                                                                  T1012

                                                                                                                                                                                                                                                                                                                                  System Information Discovery

                                                                                                                                                                                                                                                                                                                                  4
                                                                                                                                                                                                                                                                                                                                  T1082

                                                                                                                                                                                                                                                                                                                                  System Location Discovery

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1614

                                                                                                                                                                                                                                                                                                                                  System Language Discovery

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1614.001

                                                                                                                                                                                                                                                                                                                                  System Time Discovery

                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                  T1124

                                                                                                                                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                  e58abfb.rbs
                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e58abfb.rbs
                                                                                                                                                                                                                                                                                                                                  • Size 162KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 61e451265b2af51e0a6915385c2525e2e7c97319826614f2c5a1856bfc17fbc1
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  e58abfd.rbs
                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e58abfd.rbs
                                                                                                                                                                                                                                                                                                                                  • Size 163KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 b4852fb5e6de6e53e8da1e74e728c004c42be635c5dfcac5136c2629840b917e
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  e58ac07.rbf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e58ac07.rbf
                                                                                                                                                                                                                                                                                                                                  • Size 285KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 11753fed5abb0dc21ce213382b7fd665005285e240ef8309939f6c76581f3ce2
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  e58ac0a.rbs
                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e58ac0a.rbs
                                                                                                                                                                                                                                                                                                                                  • Size 163KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 ea6fd9e6be3b30f528c6f37fd36f990098d5142cfee9552395bc1cde217aff2e
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  e58ac0b.rbf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e58ac0b.rbf
                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 5fc65c9104f87c323be3c59f636f877200a2117d3eea8e36d80bc060a0c0cdee
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  e58ac0c.rbf
                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e58ac0c.rbf
                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 bd5df582ff6941cf375b31e3fefbde0b5dbafd584a15fb08d7d613e53c5d8efa
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  e58ac0e.rbs
                                                                                                                                                                                                                                                                                                                                  • Path C:\Config.Msi\e58ac0e.rbs
                                                                                                                                                                                                                                                                                                                                  • Size 162KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 e3a6c5aad0c95d25986784d4108f966b0cf492f07833fbf4b43705f3b8929ebe
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  aws_lc_fips_0_13_7_crypto.dll
                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files\Cloudflare\Cloudflare WARP\aws_lc_fips_0_13_7_crypto.dll
                                                                                                                                                                                                                                                                                                                                  • Size 2.1MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 e4a10a4411012dd93432f650e55cd8a5cabd7ec29efa6a568b50b24ebdb1e399
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  warp_ipc.dll
                                                                                                                                                                                                                                                                                                                                  • Path C:\Program Files\Cloudflare\Cloudflare WARP\warp_ipc.dll
                                                                                                                                                                                                                                                                                                                                  • Size 4.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 0ea586164d84abfd615e302283927f446b6ff7d2dac5a32777e402a3b619ac7d
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                                                                                                                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                                                                                                                                                                                                  • Size 471B
                                                                                                                                                                                                                                                                                                                                  • SHA256 261dc8ae718b4a2d8216ec0e4cb86b5d5b35e6674cb089319c22b0a940cf9c93
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30
                                                                                                                                                                                                                                                                                                                                  • Size 727B
                                                                                                                                                                                                                                                                                                                                  • SHA256 8553eaca0810f79ea97d8a3818bd22086802ba0dd377dab815dd1797c9f89bac
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                                                                                                                                                                                  • Size 727B
                                                                                                                                                                                                                                                                                                                                  • SHA256 71e770baf770df80afddd7cc435ea47e9cf740a84308bb1f032eee849467be24
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
                                                                                                                                                                                                                                                                                                                                  • Size 342B
                                                                                                                                                                                                                                                                                                                                  • SHA256 36bccbd8a8b0acc9a6669c09114ec21f61be6daa083ea2ec8ca3f878c0ceabb8
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB
                                                                                                                                                                                                                                                                                                                                  • Size 400B
                                                                                                                                                                                                                                                                                                                                  • SHA256 4fefd3bb4f2bbcae0a3f28de9c62521746a0e16fe6c9b96f93c59fd91ce07476
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_2D249A1547B2300A3D78D6658366FC30
                                                                                                                                                                                                                                                                                                                                  • Size 404B
                                                                                                                                                                                                                                                                                                                                  • SHA256 a4c07692eaea41db943f7e8890baa9045fa78d97b0f98e95dd373d3b5588e283
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141
                                                                                                                                                                                                                                                                                                                                  • Size 412B
                                                                                                                                                                                                                                                                                                                                  • SHA256 5cbd3d70007a5ee0babb5e342b29b952e1900727f007a0fb4be30beda1350dc3
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  WARP-GUI.log
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Cloudflare\WARP-GUI.log
                                                                                                                                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 f1101ffc58e5d948c681536747984ff8adbf25e8e53838cbd45a7eeda7945ec7
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  ipc.log
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Cloudflare\ipc.log
                                                                                                                                                                                                                                                                                                                                  • Size 290B
                                                                                                                                                                                                                                                                                                                                  • SHA256 ecec07cd43214201ced4da89e6a4105cc2fba45fae3b0b796048f1e768f6d0f7
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  settings.dat
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                  • Size 40B
                                                                                                                                                                                                                                                                                                                                  • SHA256 dc16642704bbd372b6b47bd40a67b3413b4b7662236763e613a05a38e3b945e9
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                                                                                                                                                                                                                                                                  • Size 6B
                                                                                                                                                                                                                                                                                                                                  • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  BrowsingTopicsState
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                                                                                                                                                                  • Size 414B
                                                                                                                                                                                                                                                                                                                                  • SHA256 b9484ab640ff665219ac3ccab68378fdc8f004c590780a54f35b2e21ff6d7128
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  the-real-index
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                  • Size 120B
                                                                                                                                                                                                                                                                                                                                  • SHA256 74ff4addf0e85f28be3067321cd4892c127be8f9a92549f5b3990cc9b9ea22db
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  the-real-index
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                  • Size 144B
                                                                                                                                                                                                                                                                                                                                  • SHA256 48f2c5f4a836cc2c6171b3936e97692766c23e2bbecff69efbcfc6119a419a4e
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  the-real-index
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                  • Size 5KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 eb90f3d9726a857386e2c61e5dcd6fcf1f2f321260ef80e6bc61759be7e76416
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  the-real-index
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 05aae7d53fef388c206acb403e0425dde57ee34e21ed3d46ddace87c2452198a
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  000001.dbtmp
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_whatismyipaddress.com_0.indexeddb.leveldb\000001.dbtmp
                                                                                                                                                                                                                                                                                                                                  • Size 16B
                                                                                                                                                                                                                                                                                                                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  MANIFEST-000001
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_whatismyipaddress.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                                                                                                                                                                                                                                                                                  • Size 23B
                                                                                                                                                                                                                                                                                                                                  • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Network Persistent State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                  • Size 49KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 6e7b06b22b31466c226aaf8c1c5fa64d996ca513540ed486982202e12c535b84
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Network Persistent State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 65265f3d3152520f30137d8e636514c374c34b43be3ec5ce39eeb28848eaaf24
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Network Persistent State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                  • Size 9KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 11a64dea736e495131b2909eb235303e816c88d12e2c5dcb5265c803a73e147c
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Network Persistent State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                  • Size 8KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 042d14cf94c7bd9a50224f753b93e1882cc264c73b41d3a986f5740c59bf7b65
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Network Persistent State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 a8ee7c0f260d5033e5c7519168fcc9a39b1a9c85cf6608e79f834fef21e89061
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                                                                                                                                                                                                                                                                  • Size 2B
                                                                                                                                                                                                                                                                                                                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  TransportSecurity
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                  • Size 8KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 ce50abafe2f198068e60bcac3794b035db0b7d562a6d11e4ecbccc1b3228e6aa
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  TransportSecurity
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                                                                                                                                                                                                                                                                                                  • Size 690B
                                                                                                                                                                                                                                                                                                                                  • SHA256 d671339d27539fccf8ee8359bde843c2b7dbe526093115f993b80438e8a983db
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Preferences
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                  • Size 13KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 1389ec97e1901ca187db06f72acc5672ac8dbfafaf38ee99a03c11eb005d4cf0
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Preferences
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                  • Size 13KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 107262678012d67883097bc115e7e892668d9ed3abac744c25fbe7af81d29a56
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Preferences
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                  • Size 12KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 ec3c2715e3bd6a8655fe04e2c379432dc906cde82339034ff7a7890ec0e295f8
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Preferences
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                  • Size 13KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 0cec879b8be6059737ba8c9f798a94466f8ecdf21b96f57a8a00d63dd432e817
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Preferences
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                  • Size 13KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 49b0dbde996af3d177e00a3429180e2377aed0799e1a05a07b365c21e0fe7209
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Preferences
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                  • Size 15KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 8693ffaa57058df720e9e981f932b00837e37fd540d041706451cfc4d1220169
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Preferences
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                  • Size 15KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 222eab5dae2826f7f7ee02c90493cd16630259423a9c205351a07785c0c2f6e1
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Preferences
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                  • Size 14KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 88400c7364041bc281a7bd7087743d200bd94a145b12619b773df41c99591d08
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Preferences
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                  • Size 14KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 d0c28f2fc20ac9bfb6d01e1271f5a673a792ade2f52111145d8865003467cfc8
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Preferences
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                  • Size 15KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 5c501550b4b9e0b2c371147346987af40fddaea6b4f6d3e1ea062f01694d40bf
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Preferences
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                  • Size 15KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 df879f7970eb2ff04eedf6bcafeb8182bf83d0a40e1dbbf08dec426af0dda67b
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Preferences
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                  • Size 13KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 3c34a5f4d9933b71e2bf7127b133fcfa788c2cd935c615133fc9b9dc5e0abd8e
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Secure Preferences
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                                                  • Size 17KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 82f19bdaa200c3a3056c6486f8d9171c832143077338572b10c4c0ee03580c4b
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  the-real-index
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                  • Size 120B
                                                                                                                                                                                                                                                                                                                                  • SHA256 6b6df45c1981c644f48033a1bee1d41b1e4916f1a14d12cd7c7629a4d71c3baa
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  the-real-index~RFe59bcbe.TMP
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59bcbe.TMP
                                                                                                                                                                                                                                                                                                                                  • Size 96B
                                                                                                                                                                                                                                                                                                                                  • SHA256 00b215a80919cf547e20a25f3602eafca9e50b4dc3dbc691793b38bd8848fa7d
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  the-real-index
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                  • Size 72B
                                                                                                                                                                                                                                                                                                                                  • SHA256 6473216938cd109c27a0c2b9c01332d4a112535aa7c338a498c8184a29366e56
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                  • Size 198KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 8846edfc4f3db72f07de3a3ee54c87fb3c928f5e30fdd98f4491a8a061c5e35d
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                  • Size 90KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 3b615081b8bc01a7d1825ac27a2fb5a5142e79b59d14356fc9a21bb4aa7da230
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                  • Size 220KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 2b5f6c226bdf8830c05598d3fdcbba67d788071d62bc4feb69c71f9e703a50cf
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                  • Size 198KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 d74fbffb6a22500b1050acc9cfbfc68fea9ed11b32ab76813307a6a1028b844c
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                  • Size 198KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 abbb3a7e260432efea05faf98d866eb41e82c447074a8f1dfb2ceaa4ccc1fce7
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                  • Size 220KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 9b8b2b7fc0bde727eb229c856fe53375ec9d58f7b12607bd9804fd10f2b0c273
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                  • Size 220KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 4d06ccbfdf92c7cfbbb1baea2a5d1e22ca2d98580c9eb52067a77832e8327e47
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                  • Size 220KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 87d2e2c00f2401d24f8b5d25e8ed830cb20fd5ca7534d61eb7685b52795e5af8
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                  • Size 220KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 cd43254cd178089d0e2eef199f535fa8988380d57b028ab57e50f8b924baa2af
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                  • Size 219KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 612ae79d28a474e5963e729f5df5e913e6ab504d91f1d587dff114ea78f535fd
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                                                                                                                                                                                                                                                                                                  • Size 220KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 3b6e8d2c94a766e26b67ad79174408fc4303cfa70c3db8407134325ded75f365
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  data_1
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                                                                                                                                                                                                                                                                                                                  • Size 264KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 2db5be4fb32391b5bb0a29dba8059b04d77da6a29bccb0f6abe523363351cae7
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  rundll32.exe.log
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\rundll32.exe.log
                                                                                                                                                                                                                                                                                                                                  • Size 737B
                                                                                                                                                                                                                                                                                                                                  • SHA256 91bd0c4dba211dd55e17ff59e8396ac3893c51ca80d041e310874f90b89520d5
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  settings.dat
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                  • Size 280B
                                                                                                                                                                                                                                                                                                                                  • SHA256 1eac715bceeccb15cc45a13a9b914a80ac00eeb9f178f8c94511c17b32720b1a
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  settings.dat
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                  • Size 280B
                                                                                                                                                                                                                                                                                                                                  • SHA256 2172811336537a33607e0aadb9c5ba8cadf28b2a4fcb84d32213c685b1c34544
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  settings.dat
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                  • Size 280B
                                                                                                                                                                                                                                                                                                                                  • SHA256 10c179a684e3d346d9d9547bf831601354a71b7e414cf6f2db7219a9b0652777
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  settings.dat
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                  • Size 280B
                                                                                                                                                                                                                                                                                                                                  • SHA256 5d8784beda2288d8c6d460d9ca27726422f0598dda8d94475be2c769b7060f1d
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  settings.dat
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                                                                                                                                                                                                                                                                  • Size 280B
                                                                                                                                                                                                                                                                                                                                  • SHA256 592ea12358f44350194cfe1f366e7187c9c9430686f1e988b60a04af403a4e97
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  BrowsingTopicsState
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
                                                                                                                                                                                                                                                                                                                                  • Size 414B
                                                                                                                                                                                                                                                                                                                                  • SHA256 77d0eb92971a3455436f73247423acf1ea28ce45fa89dc107f44dc7db4102a02
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  the-real-index
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                                                                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 1df30eba13ffe36dcc6a763293b27fc17787d9e389489abf6f965c78a1fadb85
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                                                                                                                                                                                                                                                                  • Size 2B
                                                                                                                                                                                                                                                                                                                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  HubApps
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
                                                                                                                                                                                                                                                                                                                                  • Size 106KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Network Persistent State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 89272458431221a418fa31c0c0e32adea6872fb34030700925a44f59fca8d0c7
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Network Persistent State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                  • Size 3KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 bf32e6390ead7106f71de741f885604fa305ef35341811e7d8bef6146662a3d8
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Network Persistent State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 b47fec4c189185021d3c3977cccad86bd168267060a8ef58ff40d96433a0e252
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Sdch Dictionaries
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                                                                                                                                                                                                                                                                                  • Size 40B
                                                                                                                                                                                                                                                                                                                                  • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Preferences
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                  • Size 17KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 fb4f66d503ec2314529cda9af2096d9b459fe61735885b5deaa8709fd1c5c9b9
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Preferences
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                                                                                                                                                                                                                                                                  • Size 16KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 59595d35a0a73553e698f23ab86aa7b06e23fbe2d0c5ebbd07974dc19e210a2a
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Secure Preferences
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                                                                                                                                                                                                                                                                  • Size 36KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 08bb3b0b21dba37bd41e15e131567b147de960d80717ad89f5bcca9a38922890
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  sync_diagnostic.log
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                                                                                                                                                                                                                                                                  • Size 23KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 5ace8c7ee239b47eb316d4772102750b43c0fa28d6589e41f5944a18a7f5d429
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  MANIFEST-000001
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
                                                                                                                                                                                                                                                                                                                                  • Size 41B
                                                                                                                                                                                                                                                                                                                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  b2a10e59-0e57-4722-860e-df43272f9ce2.tmp
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b2a10e59-0e57-4722-860e-df43272f9ce2.tmp
                                                                                                                                                                                                                                                                                                                                  • Size 1B
                                                                                                                                                                                                                                                                                                                                  • SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                  • Size 27KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 7834a507b63bb1ebd684ca1c683e98c00a6e02bb4db8fa93d691cce28c9fd718
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                  • Size 26KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 0a2ef0dc126e74853aabeda9b3c0443959a01f0e169c0734ef60f07eb0db6387
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                  • Size 32KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 cd0bd61c9a49035ed07d9c22def87cca6cec68e406d5ce34acfddb9b7cb69d3f
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                  • Size 27KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 6165a62a182e69a9735138c6c1c88f1dcc217e4be6a3130c4af58ed761e411ae
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                  • Size 27KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 fc172e690434e7e02e20a1b4b62eaaa6117fff8da85e5efee3b263c1f880fed6
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Local State
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                                                                                                                                                                                                                                                                  • Size 28KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 1066a8da1d5d244667719fc68644fb5c27f6e4f1a82dc9332fc45251f54a9a75
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  metadata.json
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 b402451b4c685307a92e00c4deee4590fd7322c97a3f911a508cc64602d76b23
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  metadata.json
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 521d8bcc92fc9b2749ef9a33b70d81b3b984e8f1369fbb8036ea15a693567c6c
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                                                                                                                                                                                                                                  • Size 147KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  metadata.json
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                                                                                                                                                                                                                                                                  • Size 132B
                                                                                                                                                                                                                                                                                                                                  • SHA256 54f761e00d363bd15db7bae3cc55144c80148a5fa1db7c3c2049e0e406a9142c
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  PresentationNative_cor3.dll
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\.net\Cloudflare WARP\VFF4u2a6H+Uav2cTFx2EoChEmC6mnEw=\PresentationNative_cor3.dll
                                                                                                                                                                                                                                                                                                                                  • Size 1.2MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 390c7ab165434c2da59f620b363f14373c75ade83dbd7c0513974ad505953ba6
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  MSI83285.LOG
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\MSI83285.LOG
                                                                                                                                                                                                                                                                                                                                  • Size 37KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 491ace53d09bbeea3fcd9b0af30740c3406b1c44e8b5d20dd413804278d56b0f
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  default.dic
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                                                                                                                                                                                                                                                                  • Size 2B
                                                                                                                                                                                                                                                                                                                                  • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  data.safe.tmp
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                                                                                                                                  • Size 6KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 7227ae075039d32eae27f39fd7659e417159436f4f5de3a539976c09662ed8ab
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  data.safe.tmp
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\db\data.safe.tmp
                                                                                                                                                                                                                                                                                                                                  • Size 7KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 cbeb35e1242d447fe8c1e126eee7592609c0700ef4419d4c42cef70eeea8f11f
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  events
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\events\events
                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 dc0a11917cfec76886ccfa138f7a607c97072758de06c030b45ccb64389fffe2
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  12a52df8-07b0-44bb-a5c1-1f8097e98642
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\12a52df8-07b0-44bb-a5c1-1f8097e98642
                                                                                                                                                                                                                                                                                                                                  • Size 235B
                                                                                                                                                                                                                                                                                                                                  • SHA256 e74de8c000ca009a8f28e4a2f216fefbe742b7d68b7671638f31aa79ffc27512
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  1bea713a-b69d-4a03-8223-31a09763dc22
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\1bea713a-b69d-4a03-8223-31a09763dc22
                                                                                                                                                                                                                                                                                                                                  • Size 2KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 4398d4c80a8c4b566a8fa8610ba3cb9a66f12f0067d03b28dac77a3d9f436804
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  307f6fc8-727c-408f-bd65-0405400abe7f
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\307f6fc8-727c-408f-bd65-0405400abe7f
                                                                                                                                                                                                                                                                                                                                  • Size 883B
                                                                                                                                                                                                                                                                                                                                  • SHA256 46a5155655666b7a08299b1bdcb9cccf0e78a49e2d1e4cbe93c3fdca13608462
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  407231c7-9570-4e94-9856-db0ffabe2a15
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\407231c7-9570-4e94-9856-db0ffabe2a15
                                                                                                                                                                                                                                                                                                                                  • Size 235B
                                                                                                                                                                                                                                                                                                                                  • SHA256 cfed75c0904f7e8feb2b1e6f505b33e3383dcbd88e0596560039f60e3e3822e2
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  889c690e-8325-4c69-ab42-20ab73094f33
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\889c690e-8325-4c69-ab42-20ab73094f33
                                                                                                                                                                                                                                                                                                                                  • Size 16KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 6dba071e0a72f10dc594f85e9726c977391fb66d37807376571b7090c7a5f9a2
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  b1ee424b-dc3a-425e-9f9a-22718a666aec
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\datareporting\glean\pending_pings\b1ee424b-dc3a-425e-9f9a-22718a666aec
                                                                                                                                                                                                                                                                                                                                  • Size 886B
                                                                                                                                                                                                                                                                                                                                  • SHA256 0ae22b512e5348845623d9e6bd21e21e8273a02bd4837d225fa6e607ad00e562
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  prefs.js
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
                                                                                                                                                                                                                                                                                                                                  • Size 6KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 6fc58249f4e84c74f8f01753748d7e026a1542ceed44f84d790430e6693904b9
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  prefs.js
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\prefs.js
                                                                                                                                                                                                                                                                                                                                  • Size 6KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 9da4019b4dc070ec7061743be77d0f7f724708a5b3736361d1c04d2304d51dda
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  sessionCheckpoints.json.tmp
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\sessionCheckpoints.json.tmp
                                                                                                                                                                                                                                                                                                                                  • Size 288B
                                                                                                                                                                                                                                                                                                                                  • SHA256 d1a98a30522d1bf882574df5ed2793bba5c4fdf0381788babea0846f6946745c
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  3870112724rsegmnoittet-es.sqlite
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\cgsfbx1g.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite
                                                                                                                                                                                                                                                                                                                                  • Size 3.2MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 0fb000ab46365adbabc5947c5df118edf380e6954ca5c2ea66755b243d8be037
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  vlc-qt-interface.ini
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
                                                                                                                                                                                                                                                                                                                                  • Size 79B
                                                                                                                                                                                                                                                                                                                                  • SHA256 2ab9138d4cc145fe2b2406a2555d22bd4106308e0bddab7adaa01133a7a8ee3a
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Cloudflare_WARP_2026.3.851.0 (1).msi:Zone.Identifier
                                                                                                                                                                                                                                                                                                                                  • Path C:\Users\Admin\Downloads\Cloudflare_WARP_2026.3.851.0 (1).msi:Zone.Identifier
                                                                                                                                                                                                                                                                                                                                  • Size 153B
                                                                                                                                                                                                                                                                                                                                  • SHA256 de2dbb0fd3dbd83f7a5b6366461cf1f52f8cb750f4cc06cd5ad6e924b380a116
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Newtonsoft.Json.dll
                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Installer\MSI8C9B.tmp-0\Newtonsoft.Json.dll
                                                                                                                                                                                                                                                                                                                                  • Size 695KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 e1e27af7b07eeedf5ce71a9255f0422816a6fc5849a483c6714e1b472044fa9d
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  MSIB2A2.tmp
                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Installer\MSIB2A2.tmp
                                                                                                                                                                                                                                                                                                                                  • Size 149KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 386a4209241d3424783e2456ef79988a1032a9f4ead891b5551253520e439ee0
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  MSIB3DD.tmp
                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Installer\MSIB3DD.tmp
                                                                                                                                                                                                                                                                                                                                  • Size 542KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 043004a5c963bb150211bbd812ef84275c5095d65951786f7674c032f38bdffe
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Common.dll
                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Installer\MSIB3DD.tmp-0\Common.dll
                                                                                                                                                                                                                                                                                                                                  • Size 15KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 3f7ca0eeb1dd21da3c7e3520de81cd69f14606c4769084e346b004e8485eb770
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Warp.Installer.Actions.dll
                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Installer\MSIB3DD.tmp-0\Warp.Installer.Actions.dll
                                                                                                                                                                                                                                                                                                                                  • Size 22KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 48097b83109cd2ad999a8945b246699fde23a97d38cff85a84a25024da388bff
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  CustomAction.config
                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Installer\MSIBECB.tmp-0\CustomAction.config
                                                                                                                                                                                                                                                                                                                                  • Size 1KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 5d6fd5049f33ac6b16ec0431787fa61c66630ba1916bb4c70f3f6b5844b74ecb
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  Microsoft.Deployment.WindowsInstaller.dll
                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Installer\MSIBECB.tmp-0\Microsoft.Deployment.WindowsInstaller.dll
                                                                                                                                                                                                                                                                                                                                  • Size 183KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 791da16b0df6956e88b04dab8b543b99dc2abd9af24aa25208fe5a0981e811b3
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  MSIC42C.tmp
                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\Installer\MSIC42C.tmp
                                                                                                                                                                                                                                                                                                                                  • Size 234KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 78860e15e474cc2af7ad6e499a8971b6b8197afb8e49a1b9eaaa392e4378f3a5
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  manifest.json
                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_1285648987\manifest.json
                                                                                                                                                                                                                                                                                                                                  • Size 177B
                                                                                                                                                                                                                                                                                                                                  • SHA256 096e772e0f2e8c15e6dec9087ee0a1fb8b0c56b25061626aedc9e7e705adfc2e
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  keys.json
                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_402580341\keys.json
                                                                                                                                                                                                                                                                                                                                  • Size 8KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 ae6e69a145f84c0a261b4e82888779fbf137f193881d687588e1af71609ae947
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  manifest.json
                                                                                                                                                                                                                                                                                                                                  • Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2944_402580341\manifest.json
                                                                                                                                                                                                                                                                                                                                  • Size 79B
                                                                                                                                                                                                                                                                                                                                  • SHA256 7ea98f2308a9c51d17a1ac71b64afbe2a41ff0a083a166a0e4cc428bf44f0715
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  metadata-2
                                                                                                                                                                                                                                                                                                                                  • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                                                                                                                                                                                                                                                                                                                                  • Size 24.6MB
                                                                                                                                                                                                                                                                                                                                  • SHA256 1981731cef7c8e01b43b3934b8be193136b308b04e9f90e6c24df31907ae51ae
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  {02c09adc-ca83-405f-b40b-cfd395600a06}_OnDiskSnapshotProp
                                                                                                                                                                                                                                                                                                                                  • Path \??\Volume{f5ca1e61-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{02c09adc-ca83-405f-b40b-cfd395600a06}_OnDiskSnapshotProp
                                                                                                                                                                                                                                                                                                                                  • Size 6KB
                                                                                                                                                                                                                                                                                                                                  • SHA256 bfc90821c49453171104e6bfdf773ff1a4f884b9e688a352b96dfaf2522e5251
                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                  memory/2024-112-0x000001F62BB80000-0x000001F62C32E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2024-16-0x000001F62BB80000-0x000001F62C32E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2024-113-0x000001F6344B0000-0x000001F6344BC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2268-1-0x000002A5000D0000-0x000002A5000DC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2268-0-0x000002A57C140000-0x000002A57C8EE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/2268-12-0x000002A57C140000-0x000002A57C8EE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3160-58-0x000001BAFF2F0000-0x000001BAFF31E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3160-62-0x000001BAE6DD0000-0x000001BAE6DDA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3160-67-0x000001BAFF340000-0x000001BAFF35A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3160-66-0x000001BAE6E70000-0x000001BAE6E78000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3160-73-0x000001BAE6DA0000-0x000001BAE6DAC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3160-72-0x000001BAE4D40000-0x000001BAE54EE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/3304-156-0x0000000000D50000-0x0000000000DCC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-194-0x0000023037470000-0x0000023037693000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-239-0x00000230369D0000-0x00000230369E8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-319-0x0000023037AA0000-0x0000023037AC1000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-315-0x0000023037A80000-0x0000023037A96000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-312-0x0000023037A20000-0x0000023037A3D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-252-0x000002303B9A0000-0x000002303C1BC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-221-0x000002303B150000-0x000002303B992000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-206-0x0000023036800000-0x0000023036808000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-309-0x00000230379B0000-0x00000230379C7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-307-0x0000023037A40000-0x0000023037A7C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-303-0x00000230379D0000-0x00000230379E2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-300-0x0000023037910000-0x000002303791A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-203-0x00000230368B0000-0x00000230368EE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-176-0x0000023036EB0000-0x00000230370D8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-185-0x0000023016090000-0x00000230160A3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-179-0x00000230370E0000-0x000002303723E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-182-0x00000230367C0000-0x00000230367EA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-188-0x00000230366F0000-0x00000230366F7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-191-0x0000023036870000-0x00000230368B0000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-197-0x00000230160D0000-0x00000230160D5000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-212-0x0000023036840000-0x0000023036854000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-174-0x0000023037E50000-0x0000023038DD8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-164-0x0000023036730000-0x00000230367B2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-167-0x00000230366A0000-0x00000230366E7000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-170-0x00000230160B0000-0x00000230160C2000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-158-0x0000000180000000-0x0000000180A25000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-161-0x0000023036AB0000-0x0000023036EA4000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-215-0x00000230367F0000-0x00000230367FB000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-258-0x0000023036930000-0x000002303693A000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-248-0x00000230377A0000-0x0000023037894000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-297-0x0000023037930000-0x0000023037943000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-294-0x00000230376D0000-0x00000230376DA000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-200-0x0000023036720000-0x0000023036729000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-218-0x0000023036940000-0x0000023036984000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-224-0x0000023036A20000-0x0000023036A96000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-291-0x00000230376E0000-0x00000230376E8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-288-0x00000230378F0000-0x0000023037903000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-255-0x00000230376A0000-0x00000230376C9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-236-0x00000230369B0000-0x00000230369C6000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-285-0x0000023037950000-0x00000230379AC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-233-0x0000023036990000-0x00000230369A9000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-230-0x0000023036900000-0x0000023036905000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-282-0x00000230378D0000-0x00000230378E3000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-227-0x0000023036830000-0x000002303683D000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-209-0x0000023036810000-0x000002303681E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-279-0x00000230376F0000-0x0000023037704000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-276-0x0000023036AA0000-0x0000023036AA8000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-273-0x00000230378A0000-0x00000230378CF000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-270-0x0000023037760000-0x0000023037781000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-267-0x0000023037740000-0x0000023037757000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4320-264-0x0000023037710000-0x0000023037735000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4392-109-0x000001BEA7940000-0x000001BEA794C000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/4392-108-0x000001BEA58F0000-0x000001BEA609E000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5164-155-0x0000000002B70000-0x0000000002BEC000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download

                                                                                                                                                                                                                                                                                                                                  memory/5612-157-0x0000020465920000-0x00000204660CE000-memory.dmp
                                                                                                                                                                                                                                                                                                                                  Download