phantom_stealer | 16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 01:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
Size 435KB
Sample260727-bpbmbstyfw
SHA256 16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff
MD5 fe2a6761da82e99dbdf387aba9b8dd89
SHA1 8903d9554c088f185ad7d8671d4e429adbb76e7e
SHA512 c80cd5f5921f4694e4a9302c80be6391a6013f270f96cac58161fb4ff1488f3c74e14a31cc70a079a2a4b1356756f121f8eeb25157bcdeafc4a7760ac4126357
SSDEEP 6144:6B+pgU8ZHm5GjJ6PTQvcwCW5YG1Fe2bdSSufD02Un0sllit+ma9/cqGIHwBRvkha:6gwHmebvT9rSkdSFfDZU0AVdkqCRJp
TLSH
T1DA94E0154BA7981BD9D6173184A2DB325A74EE402D31D68B13C8FE4B3DF2BC0F946297
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery phantom_stealer persistence spyware stealer

Malware Config

Extracted

Family

phantom_stealer

Version

v3.5.0

https://api.telegram.org/bot8676391589:AAHTKbZEAvX68o3eEKS473PsZrHlBhXct70/sendMessage?chat_id=8277275661

Mutex

QI9HRWI494K8KWISKENA

Attributes

anti_analysis
0
cb_enables_ssl
0
debug
0
keylogger
0
start_delay
0
startup
1

Signatures

Family: PhantomStealer
Phantom Stealer is a stealer written in C#, forked from the Stealerium family.
stealer phantom_stealer

Detects PhantomStealer written in C# 2 IoCs

resource	yara_rule
behavioral1/memory/2416-23-0x0000000000480000-0x00000000016D4000-memory.dmp	family_phantomstealer
behavioral1/memory/2416-25-0x0000000000480000-0x000000000053E000-memory.dmp	family_phantomstealer

Executes dropped EXE 1 IoCs

pid	Process
5092	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe

Loads dropped DLL 1 IoCs

pid	Process
3752	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff = "C:\\Users\\Admin\\AppData\\Roaming\\16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe"	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
43	drive.google.com
42	drive.google.com

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Sandsuger\Kandidatstipendiaternes\Respects59\formbrndselsfabrikkers.txt	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
File opened for modification	C:\Windows\SysWOW64\Sandsuger\Kandidatstipendiaternes\Respects59\formbrndselsfabrikkers.txt	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3752	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\rocket\datoparkeringers\Serviceprisers.ini	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3812	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
5052	chrome.exe
5052	chrome.exe
2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3752	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe
Token: SeShutdownPrivilege	5052	chrome.exe
Token: SeCreatePagefilePrivilege	5052	chrome.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5052	chrome.exe
5052	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 4556	3752	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	97
PID 3752 wrote to memory of 2416	3752	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	98
PID 3752 wrote to memory of 2416	3752	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	98
PID 2416 wrote to memory of 1764	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	99
PID 2416 wrote to memory of 5052	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	103
PID 5052 wrote to memory of 4828	5052	chrome.exe	104
PID 2416 wrote to memory of 4828	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	104
PID 5052 wrote to memory of 1640	5052	chrome.exe	105
PID 5052 wrote to memory of 3812	5052	chrome.exe	106
PID 5052 wrote to memory of 4664	5052	chrome.exe	107
PID 2416 wrote to memory of 4828	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	104
PID 5052 wrote to memory of 3028	5052	chrome.exe	108
PID 5052 wrote to memory of 2776	5052	chrome.exe	109
PID 2416 wrote to memory of 5052	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	103
PID 5052 wrote to memory of 3720	5052	chrome.exe	110
PID 5052 wrote to memory of 3736	5052	chrome.exe	111
PID 5052 wrote to memory of 3836	5052	chrome.exe	112
PID 2416 wrote to memory of 5052	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	103
PID 5052 wrote to memory of 940	5052	chrome.exe	113
PID 2416 wrote to memory of 4828	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	104
PID 2416 wrote to memory of 4828	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	104
PID 5052 wrote to memory of 8	5052	chrome.exe	114
PID 2416 wrote to memory of 3720	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	110
PID 2416 wrote to memory of 3720	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	110
PID 2416 wrote to memory of 940	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	113
PID 2416 wrote to memory of 940	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	113
PID 2416 wrote to memory of 4664	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	107
PID 2416 wrote to memory of 4664	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	107
PID 2416 wrote to memory of 5052	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	103
PID 2416 wrote to memory of 5052	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	103
PID 2416 wrote to memory of 3836	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	112
PID 2416 wrote to memory of 3836	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	112
PID 2416 wrote to memory of 3812	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	106
PID 2416 wrote to memory of 3812	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	106
PID 2416 wrote to memory of 1640	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	105
PID 2416 wrote to memory of 1640	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	105
PID 2416 wrote to memory of 3736	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	111
PID 2416 wrote to memory of 3736	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	111
PID 2416 wrote to memory of 2776	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	109
PID 2416 wrote to memory of 2776	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	109
PID 2416 wrote to memory of 4828	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	104
PID 2416 wrote to memory of 4828	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	104
PID 2416 wrote to memory of 3720	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	110
PID 2416 wrote to memory of 3720	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	110
PID 2416 wrote to memory of 940	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	113
PID 2416 wrote to memory of 940	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	113
PID 2416 wrote to memory of 4664	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	107
PID 2416 wrote to memory of 4664	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	107
PID 2416 wrote to memory of 5052	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	103
PID 2416 wrote to memory of 5052	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	103
PID 2416 wrote to memory of 3836	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	112
PID 2416 wrote to memory of 3836	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	112
PID 2416 wrote to memory of 3812	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	106
PID 2416 wrote to memory of 3812	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	106
PID 2416 wrote to memory of 1640	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	105
PID 2416 wrote to memory of 1640	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	105
PID 2416 wrote to memory of 3736	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	111
PID 2416 wrote to memory of 3736	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	111
PID 2416 wrote to memory of 2776	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	109
PID 2416 wrote to memory of 2776	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	109
PID 2416 wrote to memory of 4828	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	104
PID 2416 wrote to memory of 4828	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	104
PID 2416 wrote to memory of 3720	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	110
PID 2416 wrote to memory of 3720	2416	16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe	110

C:\Users\Admin\AppData\Local\Temp\16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
"C:\Users\Admin\AppData\Local\Temp\16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Users\Admin\AppData\Local\Temp\16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
  "C:\Users\Admin\AppData\Local\Temp\16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe"
  2⤵
  PID:4556
- C:\Users\Admin\AppData\Local\Temp\16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
  "C:\Users\Admin\AppData\Local\Temp\16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of NtCreateThreadExHideFromDebugger
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2416
- - C:\Users\Admin\AppData\Local\Temp\16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
    "C:\Users\Admin\AppData\Local\Temp\16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe"
    3⤵
    PID:1764
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e"
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:5052
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffef3c4c728,0x7ffef3c4c734,0x7ffef3c4c740
      4⤵
      PID:4828
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1696,i,7094801625090005179,18155421142092631511,262144 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=1976 /prefetch:2
      4⤵
      PID:1640
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --force-high-res-timeticks=disabled --metrics-shmem-handle=2040,i,10412591914426020488,4762506061859986031,524288 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=2036 /prefetch:3
      4⤵
      System Time Discovery
      PID:3812
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,16349077022975527296,13094517271992994955,524288 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:8
      4⤵
      PID:4664
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2936,i,202354311257613347,13294740942094335601,2097152 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:1
      4⤵
      PID:3028
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2948,i,1589813315476185402,12303605431670793108,2097152 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:1
      4⤵
      PID:2776
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3320,i,17647813656850742903,16748875047708131239,2097152 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:1
      4⤵
      PID:3720
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3292,i,12795235433239864350,16964353409292531820,2097152 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:2
      4⤵
      PID:3736
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3668,i,6822751228156712284,13102839513352141282,2097152 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:2
      4⤵
      PID:3836
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4184,i,10406744948982309456,16572952834376347890,2097152 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
      4⤵
      PID:940
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --force-high-res-timeticks=disabled --metrics-shmem-handle=3612,i,3773415675713619008,8812503751365319555,524288 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:8
      4⤵
      PID:8
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --force-high-res-timeticks=disabled --metrics-shmem-handle=5028,i,12734446388092753398,5331611518344635288,524288 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
      4⤵
      PID:3424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --metrics-shmem-handle=5212,i,12901317384500956842,2439966673941883443,2097152 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
      4⤵
      PID:2620
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --metrics-shmem-handle=5228,i,9270399918461640782,14312477078240112093,2097152 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
      4⤵
      PID:4944
  - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
      4⤵
      PID:1408
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x26c,0x270,0x274,0x268,0x230,0x7ff674e955a0,0x7ff674e955ac,0x7ff674e955b8
        5⤵
        
        PID:3020
    - - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\initial_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        
        PID:4784
      - C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x248,0x24c,0x270,0x244,0x274,0x7ff674e955a0,0x7ff674e955ac,0x7ff674e955b8
        6⤵
        
        PID:3860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --metrics-shmem-handle=5252,i,3624252924287663568,7974582334034672149,2097152 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
      4⤵
      PID:2080
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --force-high-res-timeticks=disabled --metrics-shmem-handle=5372,i,11508055344052501385,10268436565841560393,524288 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
      4⤵
      PID:3424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --force-high-res-timeticks=disabled --metrics-shmem-handle=5388,i,7065742904946616336,7109624552362574563,524288 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
      4⤵
      PID:1556
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --metrics-shmem-handle=5140,i,6571799817126956419,11656638144977233909,2097152 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
      4⤵
      PID:4424
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --metrics-shmem-handle=5240,i,3474950501050818599,1984194936991672535,2097152 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
      4⤵
      PID:5380
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --force-high-res-timeticks=disabled --metrics-shmem-handle=5628,i,12944229237575770791,11820396925702064250,524288 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
      4⤵
      PID:5388
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,1928363179546168806,3693254220716256106,524288 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
      4⤵
      PID:5396
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --metrics-shmem-handle=5268,i,11328413635388534935,3836446785473447092,2097152 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
      4⤵
      PID:5404
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --metrics-shmem-handle=5572,i,12961001031832957520,10496347534512394174,2097152 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:1
      4⤵
      PID:464
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,14123353165791533716,3313103991422327985,524288 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
      4⤵
      PID:2620
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --force-high-res-timeticks=disabled --metrics-shmem-handle=5740,i,16440127823141121244,5569435370435971766,524288 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:8
      4⤵
      PID:1508
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --metrics-shmem-handle=5640,i,3568235189297519771,7913882321322830840,2097152 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
      4⤵
      PID:5340
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --metrics-shmem-handle=4452,i,4914146633736381961,14531668824894311562,2097152 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
      4⤵
      PID:5604
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --metrics-shmem-handle=2936,i,478200122822287794,6339261974154537059,2097152 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:2
      4⤵
      PID:5628
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --metrics-shmem-handle=5232,i,6667154374138570555,17290370987121462454,2097152 --field-trial-handle=1980,i,11501960641737281831,3575561028492787164,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:2
      4⤵
      PID:5612
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\aecgdzqf.jex"
    3⤵
    PID:5572
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir=C:\Users\Admin\AppData\Local\Temp\aecgdzqf.jex
      4⤵
      PID:5360
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1992 -prefsLen 27099 -prefMapHandle 1996 -prefMapSize 270279 -ipcHandle 2072 -initialChannelId {3ef6e645-01ee-4762-9b8e-84d6e506771c} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
        5⤵
        
        PID:5924
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2128 -prefsLen 27135 -prefMapHandle 2132 -prefMapSize 270279 -ipcHandle 2492 -initialChannelId {48f965fb-4c0f-4245-a6af-cde780e705ab} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
        5⤵
        
        PID:5964
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\4e2dd375-b8a7-4a40-b176-3aa20c985e47.dmp"
        5⤵
        
        PID:6016
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2244 -prefsLen 27135 -prefMapHandle 2728 -prefMapSize 270279 -ipcHandle 2748 -initialChannelId {41e84576-16ba-44d8-932a-d710f9b66eba} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 gpu
        5⤵
        
        PID:6036
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\e7b85269-e6d4-45d7-815b-c3a9894297e0.dmp"
        5⤵
        
        PID:5196
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2864 -prefsLen 27135 -prefMapHandle 2776 -prefMapSize 270279 -ipcHandle 3108 -initialChannelId {7e28216e-e99e-413f-b6be-128f25c3a212} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 gpu
        5⤵
        
        PID:5172
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\c0f041ca-0469-464c-9efd-25460f0fc6b0.dmp"
        5⤵
        
        PID:4488
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3108 -prefsLen 27200 -prefMapHandle 3312 -prefMapSize 270279 -ipcHandle 3328 -initialChannelId {864d434a-938e-4479-8363-637a3a29242c} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 gpu
        5⤵
        
        PID:5472
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\8790ca3e-d496-44c7-9d24-27a38df12ce5.dmp"
        5⤵
        
        PID:3684
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3152 -prefsLen 27200 -prefMapHandle 2996 -prefMapSize 270279 -ipcHandle 2980 -initialChannelId {957fda7f-d352-4313-8903-395457a19e6e} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 gpu
        5⤵
        
        PID:5320
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3264 -prefsLen 27325 -prefMapHandle 3672 -prefMapSize 270279 -jsInitHandle 3680 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3688 -initialChannelId {7bb9c5cc-d328-48a6-8db4-b58268a2e4f7} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
        5⤵
        
        PID:2632
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\b49a066a-c6ca-4a7f-ba9d-55403340f0e7.dmp"
        5⤵
        
        PID:4604
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3548 -prefsLen 27325 -prefMapHandle 3552 -prefMapSize 270279 -ipcHandle 3536 -initialChannelId {7e03b1e2-d936-4d96-801c-94e7557d012a} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 gpu
        5⤵
        
        PID:4884
    - - C:\Program Files\Mozilla Firefox\crashreporter.exe
        
        "C:\Program Files\Mozilla Firefox\crashreporter.exe" --analyze "C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Crash Reports\pending\a0133504-5c1e-4932-a219-c2839fed97b1.dmp"
        5⤵
        
        PID:5724
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 4000 -prefsLen 27325 -prefMapHandle 4004 -prefMapSize 270279 -ipcHandle 2052 -initialChannelId {2f5bd309-d66b-4659-a67c-8d7d30ee7765} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 rdd
        5⤵
        
        PID:5760
    - - C:\Program Files\Mozilla Firefox\firefox.exe
        
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4312 -prefsLen 34824 -prefMapHandle 4316 -prefMapSize 270279 -jsInitHandle 4320 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4328 -initialChannelId {ff8d537c-4e46-4269-a0af-506e8cab823a} -parentPid 5360 -crashReporter "\\.\pipe\gecko-crash-server-pipe.5360" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab
        5⤵
        
        PID:1616

C:\Users\Admin\AppData\Roaming\16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
C:\Users\Admin\AppData\Roaming\16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Program Files\Crashpad\settings.dat
Size 40B
SHA256 e2fbd63c02b5359c151edbd45b5dbdb2570dae63d3e383f72e5370d493ca4059
MD5 707288ea22fe5427c640129deb8effce
SHA1 9098d4ea544e5e33feb3a5d6eda201db7091dcf5
SHA512 23c7a7f635b642b4f2e8db1444812e6b8016b0d5b968b9cf03f912cdefa6812f690a3b0251fd73bb57ef1d7d43bee87181a3bbd0cac85f38fe2f9d859bfeaa55
MD5 SHA1 SHA512

Submit Download

chrome_installer.log

Path C:\Program Files\chrome_installer.log
Size 8KB
SHA256 390a52ce4077aa88733b9a4314ac5d5bb9a0668091b27e12e5b9070c75e98485
MD5 f2503c2a721ef2c9f22072f82229a168
SHA1 56a21161214e0bc308921c3dc28093991c9b4c76
SHA512 2f68efb21fd0b83fb74242d5d2b9b8233328716ad59a5896eafc5b400fc73bcdd263b3e2bbe1e471d1daa724b827202a3dbb8c26032201cf280f4db1501bd77d
SSDEEP 96:fMyayFTqXO3jeEXjhK3sK3NJ1+/cHUwChK2lK2cqlIWqv8cEgNRhK3+K3rp0:G+l3pPUC/fzmv8mJKa
TLSH
T1C712ABDA4E02486F3B828F6B334332615E9B240AD7E455723BDF9615F0CA968142FDB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

050a8e4f-0216-40fa-a9c5-d7543ed56371.tmp

Path C:\Users\Admin\AppData\Local\Temp\050a8e4f-0216-40fa-a9c5-d7543ed56371.tmp
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nss2202.tmp\System.dll
Size 11KB
SHA256 2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc
MD5 a4dd044bcd94e9b3370ccf095b31f896
SHA1 17c78201323ab2095bc53184aa8267c9187d5173
SHA512 87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a
SSDEEP 192:em24sihno00Wfl97nH6T2enXwWobpWBTU4VtHT7dmN35OlESl:m8QIl975eXqlWBrz7YLOlE
TLSH
T168325C12135081F3E4918138886B3A276B6A15029BF98E57DFD39646BE21BE3BD7D603
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Crashpad\settings.dat
Size 40B
SHA256 5e608d1909271ae65ed8ff219a71a648c893f4954021df4b0a1726707378dad1
MD5 a73e771882c11fa6d3a7259498a6285e
SHA1 7f3a883e8bfc87ef601ef8eacb62ace88dc2db78
SHA512 1d6c8b4a75de935b763906e59c68f945d2e14807b4984e488f060edd77fa4d0fb1dd187432070797a15dd2caefee216d8c2920160e3cbf744d866b327fd1617b
MD5 SHA1 SHA512

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\BrowsingTopicsState
Size 414B
SHA256 1bd29f668972feb1762f00427dc8fa396c0b7307e6d158eceed0f77dd796a3c7
MD5 07257e7528f8ef9717ed463b14300f88
SHA1 14588c2bed12134ec92dc5b96349cbeb10d44d82
SHA512 94512db6c64b6c5425138f8e4cb79a444cd492ee110128b52e1be19de6f7e4df79f42787c5098d775aced4885d3a59c5932e7f5cc9da2e9d6f935dad438eb7a8
TLSH
T183E0ABEAD825DC371AFD071C50640649FA0113571A80484F763C42098FB063701A2C9C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Cache\Cache_Data\data_0
Size 44KB
SHA256 b492b7e69f8d41f3f883695b9181151092771e2a8c61edfdcbb21c71c92d2e87
MD5 b63d643444e57d9b90662e0fb097731b
SHA1 ebc9498092c4969ff856a7dc0ad9b598a4bcb707
SHA512 fc367cbf7b0dc2ed4f958d381d356cac961e5d6b5d5f5519b5669a201fcf6ee290845c090172524e6aac498891dffb3d104c4dea86b31d06ffc7d0acf9c48c3b
SSDEEP 12:d7XjFXanN0LzQlDB/KZqkEvMT8/nZMGyT:d7TFXaNDBmEn/ZMGy
TLSH
T1D5135E6FD9912E1BCAF90CBC188F7BB0B3B09004D9A2B65786607629A196321415E201
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Cache\Cache_Data\data_1
Size 264KB
SHA256 d1ffeaacc741ff4efc4f1c063e9c8682998c5afe0ffc9c73e81023b7d6e5e2d5
MD5 7d2749d0919f5ab69ba0c6ddb490e605
SHA1 4fc4fcb4328efe4e4f1cfd8eb17dd69804629a04
SHA512 900361ccf4a491fa869aaeba8b8fb3d9c2d0a4efa4f432fc408025d1eb1a523db6882ab329fb60ac8897987d5f0d93ba7d4645174b49cf2858cddf88a66204b9
SSDEEP 48:rKfldTVYZJO5eD0HRE5KAeM1XghuXXlMmXgdVEPLVBKWwtl:uNty7O5eqWeughOXljeVOLHKWol
TLSH
T19F44C8F72D10DDC6DB59CBB46C42923CCE3297361CA9FDB5F52884A25190AE732186B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Cache\Cache_Data\data_3
Size 4.0MB
SHA256 f2356c824ee4dcba259f24e0dace44514eb9b074ca86d6f9fcabfb5d7077738a
MD5 7d9e79c86e4d47273709808943d73956
SHA1 8ccfc501a480f6924f3795c9fc6115f2a4a0accb
SHA512 d63b9377b8a0c4188edfb34f41ce69d8a24d85653e29a1a3b4d5b16963b8b17ffd41c27f89d534294eff663fa233852917698074a45a3628e2a1346a3ab2002d
SSDEEP 768:AUfDPLSgcRUv+S4tfDPLSgcRUv+T4XUfDPLSgcRUv+e4SUfDPLSgcRUv+C40Pz4b:ndJgnztxFzJz
TLSH
T15D164DB64F68B942E785EEB0FBCDED1C3CB022C5ECD25892F01292694AE4FC41B8515D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000001

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Cache\Cache_Data\f_000001
Size 37KB
SHA256 0ddef256db017002035d507131a6b31a3905cca04c79500f300a950d448a1fa8
MD5 980605f2c8615ab138ed122cc3e3d119
SHA1 ce432b2ed937ea7740676f8b995d7379203ecaf1
SHA512 f0130d84e2b12041be7d068ca1e9f4f22b3e9e7742800b4c056f6313a965a90250aee18327287731e84467498030702b6fb24d6bed8e43d407eaa87b39fbf1c4
SSDEEP 768:0Ls4qz8qEymC9GHcJGw0ri/kyBuHILEKUySOydSW6noaLmAk:0Ni8rmicJzIckyBWILEKgOydmjtk
TLSH
T16503F1E2D8D7A5314A0F79BCF3649C217AD5E8EF62461C607E1083D75C950FB2B5801B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000002

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Cache\Cache_Data\f_000002
Size 68KB
SHA256 6a61b95e873e0f5505dd480208c00ac0e32a4d913209648a9825332eb8b9b6fd
MD5 7637378e46397a3f66a65894969d73e7
SHA1 cda8574cdb9a71fb96e173cfd0a1d9189604c08b
SHA512 fc3e5fbfdc0c873271c306c8fa75150d43366463cff354b2c146dfb3dbf195eda1d87077a90177ad5c2e6e993ae1f823bb1eb7535afa5c041c632d62fa67b971
SSDEEP 1536:ZEqcbzcJJpTE0N6EvOHns627rRH/WipIdENTEQVInkL/XKjaaZVjC:ZEq4zgTRN6IOHG7VfWipCE1BFjKhNC
TLSH
T1B063120A8BD6953ED5F73F867B38630D235A70DDC74288A7FB20A4A12356C2D916346D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Cache\Cache_Data\index
Size 256KB
SHA256 888338ecb6b4ec28f989f5923b3e7197184a4329bb4552d571ac06bbed5acab2
MD5 4cfc77d9f23194324530ef5d2704b28e
SHA1 a61ea952a4d269a59ba8599f14388dcf597ad83f
SHA512 a6a8b6e2c356fe279da49e8980c4da665cda8919c511bf644a551237a0efa737a9a91db60a3f9d4d3dd91017b3a9e6d17aad305cf58578ef8ec17c77cde82135
SSDEEP 3:LsLllFlklNllklkXlbGGl6/ollLll/nMll//Zllll/ZNtlmNtl3Nl/lglNlXl:LsRa3lPt3yltzlllhkNH
TLSH
T1CB4411AE83822E02C2C002FC80038B203338C808CA8F8B03030822202CC0B802F0F0A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba678a2fbd8c358c_0

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Code Cache\js\ba678a2fbd8c358c_0
Size 298B
SHA256 5c9693e607bc4a6f30a756512781f761dc39259671848d218e355bd898223100
MD5 67d531402b2ed6f8d241e1f93fd8bfc0
SHA1 fb9066e3268af3aab8a828195d50485a5fbaf910
SHA512 95055c823aacde7d38362cd930d7c8669a7c1164418fec74892670dce1cc580c0acf233cf532807350a1ddcc6c4e06945a7ed47b949972f3f95465de3aa0495d
TLSH
T100E02B81825C0F0DD32D96F7CDAB03058A0F52C42ABE3603A980C2C573169341288222
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Code Cache\wasm\index-dir\the-real-index
Size 48B
SHA256 0e6704fa3fdd0625f898fd3153e24d95c9b003461d69179a126a5e976a7377d2
MD5 c07d3245fd16fdf829118df2649d84d1
SHA1 eb9f86271384d9c615dba83bfc0da422759ed279
SHA512 1970648dcf517beb77d4b780642440e031576dba99591cddde69992d91c6aab9489f477903e9f5cd42a019f826295452701045b35bbd06b1fc55e475d5885c1e
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\DawnWebGPUCache\index
Size 256KB
SHA256 5344b6620d3ce22b11f51031849e7b76790c85e16a6ce38f0f1087a5c0e2f3c8
MD5 d28bd4b75292f5781f980186f0b4b1cd
SHA1 2d9b8b91ef027066d7676998e10a2297ecfeb36a
SHA512 8aab750b73ecfb575013e6a2aab9d8583daa36c320d9b8cdb48d02a9408ccecd56afb5234652c838a4c0cbb616d877d1711cf54655ac85482f22d1e2568a522a
SSDEEP 3:LstlNllklkXl+:LsX3lP+
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

service_worker_bin_prod.js

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.108.1_0\service_worker_bin_prod.js
Size 131KB
SHA256 5b83ed539c1e9c2769e4e3cd4aa397a66bdd6cfa763e230414c0a885a350903a
MD5 8b795eb263421a7d53c5d4a95646bc45
SHA1 4e48ea3d490b84aa4260a74217ed414bef6b6ad8
SHA512 fb78511b7a274d3c280da40341f19fcd3c2455f6132c41f3e46696e458126a3cec6b27d41b28b2398c622c435a3bb93a2f731fe3e8ed453d365c042b71b8b0dc
SSDEEP 3072:JXNTunelO5KQOpZgLJqVPgbcBJptE/ml/3y7:JAPJOrgmptE/mlP0
TLSH
T17AD3DACCB7A5B4224363A5F5002F010BB23AB8AAE44C85A8F188D9E97D7546D4737F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\en\messages.json
Size 593B
SHA256 92f1246c21dd5fd7266ebfd65798c61e403d01a816cc3cf780db5c8aa2e3d9c9
MD5 91f5bc87fd478a007ec68c4e8adf11ac
SHA1 d07dd49e4ef3b36dad7d038b7e999ae850c5bef6
SHA512 fdc2a29b04e67ddbbd8fb6e8d2443e46badcb2b2fb3a850bbd6198cdccc32ee0bd8a9769d929feefe84d1015145e6664ab5fea114df5a864cf963bf98a65ffd9
TLSH
T109F09C8CD050E86F02B2411AB1647314FB51037A0751A59F393CDC0D9FB6DA751C6F4D
MD5 SHA1 SHA512 TLSH

Submit Download

craw_background.js

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png
Size 1KB
SHA256 bff3a19327fd09a24c1aa4e7f34c508d7e668a8eb32f2cc7c33bcaa7e9ee2319
MD5 2f1881da261cfaea89605ee7a5e33e40
SHA1 fe61ed428aa3636adcfbeb66162f43f0ee091d25
SHA512 a9d8a4172c83030bf4472e900540b2ef3bbbb5e565c39f278cb8aae355354f063a4723c5ed8c3b32dcea45c70903271d170e56879a096b169697fc28dc768494
TLSH
T1FC413B2333F81ABFD81CD69BE465C8A50F395483DA39060706031CE8116343B19DDAF9
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png
Size 2KB
SHA256 afbfdd55b59a6385a28bfe27ef81ffae07f9d77b8c073dc299c6060b5d964a89
MD5 4d5d17c7e7c06b887bb383077131f50e
SHA1 8b29cf29af8358672e31bee5472025b7b07e7df8
SHA512 ccb20424ba2566e11a359bd04cbcb54bc21947bc254f4939c334f7db8c784a1da35461f60a1fc559ab5bde5cda443c82b633b8cc5bda89f5019b391148050be3
TLSH
T179515DED0389C698FB6F764206866917621D39F824EC51E09AE816A3EB101AC1CC1FD2
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png
Size 3KB
SHA256 02bd0f5d045eb5247e576d8151da19d36dc0eee7746c9a426d4dc92ee83125c8
MD5 aceb6eccca82014c9472e49e8b4b6eb4
SHA1 91d2c703fe33ea1867dd3d87b760aa2e5e68a55a
SHA512 b18d0edf51fb6245dc730b5aca21601dc40c762d6c3d96c950b38312406bce16fe7165e786bd0d6ee106d95c90139094bfc4fca08b0f37eb88c086606821ade4
TLSH
T111814D53467373A8BC788965CBCDD0EA8D732D594E4244F884CAD93429D54049825BDF
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png
Size 1KB
SHA256 ccefdc2d816137b5954b591e8954c392e0cf27388fef2e437991e3999d9ad3d8
MD5 efa437b6fe5031994d5917a91c19990f
SHA1 d46a1115227ead4e92346b600c28e9ac72cce96f
SHA512 ab52261f15a3f21728b41b4765da5ec6c9e71051b720204ee2decf6f09ac8a0c9a5c12313d921f232f1e698a7425d34415eca8db21a37f423535806bcdf238bb
TLSH
T1F3310AC7644047BA52EDDAF37F6B0C57DC12210107D4A440599F56E17FEEEC86015478
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png
Size 2KB
SHA256 bff87e21fa845d8ce3c266db6d904e9c7a3bf9fc2b95a1f1a5ca375f3fdb045a
MD5 097f67b0d583db3f8487ac27379c7eae
SHA1 18acf62fb9bc4e95899c4597cd72de66b6bef763
SHA512 0b6b323fa14e5b0dd6bb87fce791bbd0b7a867988d8332385ba76a35d93d4dd5b67f6be9be5a69fbdcd5da68c30bc840712daa83b9a0187b727d963dc9a9a045
TLSH
T15E514C54BEF34CB2EBC67C7254E65BF5A564C1E62D407A0C86B9CA1245BDD410CCD003
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png
Size 3KB
SHA256 abe4eaa1a6fa423bcef61b423dc72386a9cf1968b1041de5270c56a7780254ad
MD5 8e589c60e0ba95ca1b178bad0a8298db
SHA1 d981cd3f9eb63636471e3bd4c0fd7585460ad6fd
SHA512 e8c7b5d340e698f3b1b42d6c3b7653b666e0add095611c00f502782928eb788070ca977b54b42f9515127861e55138a3cc0f02540f0bc2e44694fb0ea595ee34
TLSH
T196517D1B4B8AC56A0E53770E02E57ED454996C569EF383CC2106E7C0081A99F43EBBE7
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png
Size 952B
SHA256 e566796c18517e7084e3a892b3291cc189b85e7830800503c256998ab697a507
MD5 bf7aa030f9cbc7aba123d10adb3ab321
SHA1 d210f3194a494a65d1e32ade703e24fbbef7b444
SHA512 3be8123811222e1d5aa92e7144d41a8ace20ea1d5b082aa51d11df8f573c17f294ead72ee9e94b31259035ebd0eecb904686cf4bb22f0e5313a02756e210b8a6
TLSH
T1E311889E6EAA8CBDD1C3AE4FBD2D22904F13CE54C534BA1B4C4759573A26E54704B501
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png
Size 1KB
SHA256 6a379d8e9545ee7885dcff4c53f1ca553dc9fb0cbaa18a0c71c0b75c8883d044
MD5 c053b2219c4c9e7e7080cbe4e6e3981e
SHA1 0470cf45babbbe1fad32b4dec3593e8ab7a8ac39
SHA512 1271ac3ef670f3b7104c3f4e678ef4bc9990d9427826b104bfa8d31f904895da50ed0f1b673727d39355428f6270d015c0953521b26d8f10f842854b79ec5525
TLSH
T1E021B7BE5B25DE1B97EEA61F72DA9900D89221E27183A6052ECFCB6057145A33C24172
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png
Size 1KB
SHA256 3772d9c9a6fabba60ac0c7b9c93bf230e3c99ebac9af480efc6c778d9881dd85
MD5 cf9a569f60db18903e86e6612cf90efc
SHA1 379dccdc92399b0e4e658ad8f04276bf99501836
SHA512 58f0b5130318069511452b11b1fbdfd898577c714150f5f88a4a4ff80320b33c287c103e464ef24c8543d90de71713f2ee293f538fb078ec2099f9871cef2caa
TLSH
T132210853AFCF4AAE5834129F565C460FFBA3623E2952D409DB2A41AB08CDC14E8462C3
MD5 SHA1 SHA512 TLSH

Submit Download

32.png

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\32.png
Size 1KB
SHA256 06c00fa3cb29713aa4317b352fc1e1e035c0c7720a42f107cf758fbb21eaed0c
MD5 247675501d3cf1f7987fe8e20dc4a994
SHA1 c0630fbc0c9c7c2aec627667b21b5b9add1d7925
SHA512 6b6f5e0feb15ecde82191178df36fcf9cebb762289116b88a466ab31152d6f8e769e97252e3a41f7f538867920866ce12bd60c9c87fbb5019783de0c5158bfd8
TLSH
T1C721DB9786803C5AE71F76BD5402AE9BF92060197254970E1A560A15C93C5D3FD873A0
MD5 SHA1 SHA512 TLSH

Submit Download

48.png

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\48.png
Size 1KB
SHA256 bebe7c8f23573efeedb8259fd9e866662dfad2c8e974d2715bb5aebdac870f6d
MD5 93f26885517b76f003062053ad718275
SHA1 eb97bbd3de38ad8efd87e112ad76d6a6d78ffda9
SHA512 34f8a81113a9ca950a07c5f5c3511e3f11f8f9e9a2a1040872015064e2146154d4eb31b33d8ee291434535881f82685c0e90c52e76ea731ecafde73771595520
TLSH
T10031F95284AF0C128406F5E5CD57910B7F37ACBA9AC2A589023B7E7A105824D7B6C449
MD5 SHA1 SHA512 TLSH

Submit Download

64.png

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\Default\Web Applications\Manifest Resources\mdpkiolbdkhdjpekfbkbmhigcaggjagi\Icons\64.png
Size 2KB
SHA256 f5fcedc00655f8a9b63b379feb04ef904a64328e9ef79e7a411de5139d398ebe
MD5 18b13f82a338cf91ce3ec3ad9702622f
SHA1 403a48626de0cb33ddea61e6de7c895eb7482bca
SHA512 08a6fac277ffdbbc18c5166032b426e7d8a7856f7dd03ab01938000b28a869d80476017164a6728643ae8908616c574fddd8fabf946bd66b841ef13f5906969b
TLSH
T1F7413AD73E887CDDACB22A746A6175C1F0E846B24687DF44E60D6918CF61C43001638C
MD5 SHA1 SHA512 TLSH

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Temp\pi3efls3.k5e\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

831bb925-67eb-4d98-91bc-5fe8dbc78514.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5052_1476152426\831bb925-67eb-4d98-91bc-5fe8dbc78514.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir5052_658065637\CRX_INSTALL\_locales\en\messages.json
Size 450B
SHA256 c0945dd5fdecab40c45361bec068d1996e6ae01196dce524266d740808f753fe
MD5 dbedf86fa9afb3a23dbb126674f166d2
SHA1 5628affbcf6f897b9d7fd9c17deb9aa75036f1cc
SHA512 931d7ba6da84d4bb073815540f35126f2f035a71bfe460f3ccaed25ad7c1b1792ab36cd7207b99fddf5eaf8872250b54a8958cf5827608f0640e8aafe11e0071
TLSH
T1D3F055CB9000FC5E538BC00EB10072282BA603E01AD1726724EC1C0E67DFDAEB143F9A
MD5 SHA1 SHA512 TLSH

Submit Download

16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe

Path C:\Users\Admin\AppData\Roaming\16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff.exe
Size 435KB
SHA256 16131fdd48c28529684d83a0687e3500e70c6abd8d86fbaefd49cbfdff57f5ff
MD5 fe2a6761da82e99dbdf387aba9b8dd89
SHA1 8903d9554c088f185ad7d8671d4e429adbb76e7e
SHA512 c80cd5f5921f4694e4a9302c80be6391a6013f270f96cac58161fb4ff1488f3c74e14a31cc70a079a2a4b1356756f121f8eeb25157bcdeafc4a7760ac4126357
SSDEEP 6144:6B+pgU8ZHm5GjJ6PTQvcwCW5YG1Fe2bdSSufD02Un0sllit+ma9/cqGIHwBRvkha:6gwHmebvT9rSkdSFfDZU0AVdkqCRJp
TLSH
T1DA94E0154BA7981BD9D6173184A2DB325A74EE402D31D68B13C8FE4B3DF2BC0F946297
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\n6kourw2.default-release\datareporting\glean\events\events
Size 1KB
SHA256 cdf850dcd1ab2c1861867efd493af91cad2a1c7e8b630128ef5ca7e723f0207a
MD5 791ef5bdb697d3aeeb420174478e6b45
SHA1 3b07ee0c2720d29c1e262269f79b6812fcaf29bd
SHA512 d1eb9fab5c389cb6edc2ff585760d4c8a6332d8513733f85d2ad78cbc43742991c2397e73071db8b274b9357e65f7b4ff8d14bb963ff2892dddba8364377bd46
TLSH
T1FD21799C7DBC4DAA98CBF39C7451028E57918F0705972E470D42EFCCCE86AD9326A839
MD5 SHA1 SHA512 TLSH

Submit Download

Nohes

Path C:\Users\Admin\AppData\Roaming\erklringsoplysningers\Nohes
Size 17KB
SHA256 547a04095767c5c6a35ac0f4ea18a58e27dea4f7ea31105c6e1ca6dd06254bcf
MD5 5014a9f1a1c938c67005824460c8eb1a
SHA1 cd781bbeec1c11eebdad7e0ff7b31ca7e328adcf
SHA512 06e876c49f53a6224fd2097a4318a75da28f10d8fc19267b1929693035f1b49e67000e4f6759e426d5b4fee3c5bb5f1e2ea054a5d3556fe933ca270460829f34
SSDEEP 384:oePgNI9RWoOynEBQw7SCZCV1eE+PHq3ZVDOfn2AtV:oePWWbOyyaC8VwV4NcDL
TLSH
T1E5829E0AC31AAC77C45BC63CD46C92E1CD142053A7ABC1BEC03AB408C5976F967ADBE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2416-25-0x0000000000480000-0x000000000053E000-memory.dmp

Download

memory/2416-37-0x0000000076F99000-0x0000000076F9A000-memory.dmp

Download

memory/2416-11-0x0000000076EF8000-0x0000000076EF9000-memory.dmp

Download

memory/2416-12-0x0000000076F99000-0x0000000076F9A000-memory.dmp

Download

memory/2416-13-0x0000000076F15000-0x0000000076F16000-memory.dmp

Download

memory/2416-54-0x0000000039590000-0x00000000395AE000-memory.dmp

Download

memory/2416-53-0x0000000038FB0000-0x00000000394DC000-memory.dmp

Download

memory/2416-52-0x0000000038EB0000-0x0000000038F00000-memory.dmp

Download

memory/2416-24-0x0000000076E71000-0x0000000076F91000-memory.dmp

Download

memory/2416-51-0x0000000038F30000-0x0000000038FA6000-memory.dmp

Download

memory/2416-50-0x0000000038CE0000-0x0000000038EA2000-memory.dmp

Download

memory/2416-23-0x0000000000480000-0x00000000016D4000-memory.dmp

Download

memory/2416-344-0x0000000038390000-0x00000000383A0000-memory.dmp

Download

memory/2416-26-0x00000000383A0000-0x0000000038944000-memory.dmp

Download

memory/2416-27-0x0000000038390000-0x00000000383A0000-memory.dmp

Download

memory/2416-34-0x0000000038C30000-0x0000000038CE2000-memory.dmp

Download

memory/2416-28-0x0000000038B50000-0x0000000038BB6000-memory.dmp

Download

memory/3720-188-0x000001769DF80000-0x000001769E000000-memory.dmp

Download

memory/3736-261-0x000002A9FCFB0000-0x000002A9FD030000-memory.dmp

Download

memory/3736-398-0x000002A9FCFB0000-0x000002A9FD030000-memory.dmp

Download

memory/3736-229-0x000002A9FCFB0000-0x000002A9FD030000-memory.dmp

Download

memory/3736-293-0x000002A9FCFB0000-0x000002A9FD030000-memory.dmp

Download

memory/3752-10-0x0000000010004000-0x0000000010005000-memory.dmp

Download

memory/3812-221-0x00000276636E0000-0x0000027663760000-memory.dmp

Download

memory/3836-251-0x000001D716B60000-0x000001D716BE0000-memory.dmp

Download

memory/4828-112-0x000001D207F40000-0x000001D207FC0000-memory.dmp

Download

memory/5052-179-0x000001A8D8E70000-0x000001A8D8EF0000-memory.dmp

Download