Overview

overview

10

Static

static

3

130b282dc6...96.exe

windows7-x64

10

130b282dc6...96.exe

windows10-2004-x64

10

Resubmissions

16-10-2024 07:13

241016-h15g4sydlc 10

16-10-2024 06:49

241016-hlb71sscpq 10

Analysis

  • max time kernel
    146s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    16-10-2024 06:49

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    130b282dc6eb40ad9df048de58ac4e96.exe

  • Size

    1.8MB

  • MD5

    130b282dc6eb40ad9df048de58ac4e96

  • SHA1

    2195152ae0ed7102147302131e3c4069df145892

  • SHA256

    86b9d17c28f513e6610f028215365d251053d95326a6e2d4dc5d3d84d791887e

  • SHA512

    f3106a723038e069c23730b2613c0da43185857d5b2c3b8bc47f637910a961f9fded496ba0181b32499ca82cf1f29695401289d1f5417de33afb839652db6ce1

  • SSDEEP

    49152:VTRL60dYPWc+u/DRvkEmtk8Ziitqaxu+W6av6I:VTRW+s+uVvbKTtqejWdv6

Score
10/10
amadeycryptbotlummaredlinestealc9c9aa5default_valencigadomafed3aatg cloud @rlreborn admin @fatherofcarderscredential_accessdiscoveryevasioninfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

amadey

Version

4.41

Botnet

fed3aa

C2

http://185.215.113.16

Attributes
  • install_dir

    44111dbc49

  • install_file

    axplong.exe

  • strings_key

    8d0ad6945b1a30a186ec2d30be6db0b5

  • url_paths

    /Jo89Ku7d/index.php

rc4.plain

Extracted

Family

lumma

C2

https://drawwyobstacw.sbs

https://condifendteu.sbs

https://ehticsprocw.sbs

https://vennurviot.sbs

https://resinedyw.sbs

https://enlargkiw.sbs

https://allocatinow.sbs

https://mathcucom.sbs

https://clearancek.site

https://licendfilteo.site

https://spirittunek.store

https://bathdoomgaz.store

https://studennotediw.store

https://dissapoiznw.store

https://eaglepawnoy.store

https://mobbipenju.store

Extracted

Family

stealc

Botnet

default_valenciga

C2

http://185.215.113.17

Attributes
  • url_path

    /2fb6c2cc8dce150a.php

Extracted

Family

amadey

Version

4.42

Botnet

9c9aa5

C2

http://185.215.113.43

Attributes
  • install_dir

    abc3bc1985

  • install_file

    skotes.exe

  • strings_key

    8a35cf2ea38c2817dba29a4b5b25dcf0

  • url_paths

    /Zu7JuNko/index.php

rc4.plain

Extracted

Family

redline

Botnet

TG CLOUD @RLREBORN Admin @FATHEROFCARDERS

C2

89.105.223.196:29862

Extracted

Family

stealc

Botnet

doma

C2

http://185.215.113.37

Attributes
  • url_path

    /e2b1563c6670f193.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

    trojanamadey
  • CryptBot

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealercryptbot
  • Detects CryptBot payload 1 IoCs

    CryptBot is a C++ stealer distributed widely in bundle with other software.

    spywarestealer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    evasiontrojan
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 5 IoCs
  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 8 IoCs
    evasion
  • Downloads MZ/PE file
  • Checks BIOS information in registry 2 TTPs 16 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 25 IoCs
  • Identifies Wine through registry keys 2 TTPs 8 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Loads dropped DLL 47 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 5 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 8 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 28 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 3 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\130b282dc6eb40ad9df048de58ac4e96.exe
    "C:\Users\Admin\AppData\Local\Temp\130b282dc6eb40ad9df048de58ac4e96.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1600
    • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
      "C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe"
      2⤵
      • Identifies VirtualBox via ACPI registry values (likely anti-VM)
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Identifies Wine through registry keys
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1244
      • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
        "C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        PID:1084
      • C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe
        "C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2720
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2928
          • C:\Users\Admin\AppData\Roaming\xPW5QW1Nfy.exe
            "C:\Users\Admin\AppData\Roaming\xPW5QW1Nfy.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2204
          • C:\Users\Admin\AppData\Roaming\h0mzouAcPy.exe
            "C:\Users\Admin\AppData\Roaming\h0mzouAcPy.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2260
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2720 -s 52
          4⤵
          • Loads dropped DLL
          • Program crash
          PID:340
      • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
        "C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        PID:316
      • C:\Users\Admin\AppData\Local\Temp\1000354001\375ab19684.exe
        "C:\Users\Admin\AppData\Local\Temp\1000354001\375ab19684.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        PID:2428
      • C:\Users\Admin\AppData\Local\Temp\1000355001\eb781d624e.exe
        "C:\Users\Admin\AppData\Local\Temp\1000355001\eb781d624e.exe"
        3⤵
        • Identifies VirtualBox via ACPI registry values (likely anti-VM)
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Identifies Wine through registry keys
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2360
        • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
          "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
          4⤵
          • Identifies VirtualBox via ACPI registry values (likely anti-VM)
          • Checks BIOS information in registry
          • Executes dropped EXE
          • Identifies Wine through registry keys
          • Loads dropped DLL
          • Adds Run key to start application
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:2956
          • C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe
            "C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe"
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3052
          • C:\Users\Admin\AppData\Local\Temp\1000349001\643f7e502f.exe
            "C:\Users\Admin\AppData\Local\Temp\1000349001\643f7e502f.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            PID:2424
          • C:\Users\Admin\1000350002\96faa11ae9.exe
            "C:\Users\Admin\1000350002\96faa11ae9.exe"
            5⤵
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:1196
          • C:\Users\Admin\AppData\Local\Temp\1000357001\1dd97d643c.exe
            "C:\Users\Admin\AppData\Local\Temp\1000357001\1dd97d643c.exe"
            5⤵
            • Modifies Windows Defender Real-time Protection settings
            • Identifies VirtualBox via ACPI registry values (likely anti-VM)
            • Checks BIOS information in registry
            • Executes dropped EXE
            • Identifies Wine through registry keys
            • Windows security modification
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:704
          • C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe
            "C:\Users\Admin\AppData\Local\Temp\abc3bc1985\skotes.exe"
            5⤵
              PID:1776
        • C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe
          "C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1624
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • System Location Discovery: System Language Discovery
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1368
        • C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe
          "C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious use of FindShellTrayWindow
          PID:2840
          • C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe
            "C:\Users\Admin\AppData\Local\Temp\054fdc5f70\Hkbsse.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            PID:2064
            • C:\Users\Admin\AppData\Local\Temp\1000088001\JavUmar1.exe
              "C:\Users\Admin\AppData\Local\Temp\1000088001\JavUmar1.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Checks processor information in registry
              PID:2472
              • C:\Users\Admin\AppData\Local\Temp\service123.exe
                "C:\Users\Admin\AppData\Local\Temp\service123.exe"
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2876
              • C:\Windows\SysWOW64\schtasks.exe
                "C:\Windows\System32\schtasks.exe" /create /tn "ServiceData4" /tr "C:\Users\Admin\AppData\Local\Temp\/service123.exe" /st 00:01 /du 9800:59 /sc once /ri 1 /f
                6⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:2676
            • C:\Users\Admin\AppData\Local\Temp\1000089001\stories.exe
              "C:\Users\Admin\AppData\Local\Temp\1000089001\stories.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              PID:2448
              • C:\Users\Admin\AppData\Local\Temp\is-VU452.tmp\is-AEU5E.tmp
                "C:\Users\Admin\AppData\Local\Temp\is-VU452.tmp\is-AEU5E.tmp" /SL4 $B0184 "C:\Users\Admin\AppData\Local\Temp\1000089001\stories.exe" 4024913 52736
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                PID:576
                • C:\Users\Admin\AppData\Local\SDKPlayer\sdkplayer.exe
                  "C:\Users\Admin\AppData\Local\SDKPlayer\sdkplayer.exe" -i
                  7⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  PID:1820
        • C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
          "C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:2760
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c start context.exe
            4⤵
              PID:2244
              • C:\Users\Admin\AppData\Local\Temp\context.exe
                context.exe
                5⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: CmdExeWriteProcessMemorySpam
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1752
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 728
                  6⤵
                  • Loads dropped DLL
                  • Program crash
                  PID:784
          • C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
            "C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe"
            3⤵
            • Drops startup file
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2320
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
              4⤵
                PID:1712
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
                4⤵
                • System Location Discovery: System Language Discovery
                PID:856
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" /k "taskkill /f /im "InstallUtil.exe" && timeout 1 && del InstallUtil.exe && Exit"
                  5⤵
                  • System Location Discovery: System Language Discovery
                  PID:848
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im "InstallUtil.exe"
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1588
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout 1
                    6⤵
                    • System Location Discovery: System Language Discovery
                    • Delays execution with timeout.exe
                    PID:900
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {93FF95F6-181B-4718-982E-F9EB999AA70A} S-1-5-21-4177215427-74451935-3209572229-1000:JSMURNPT\Admin:Interactive:[1]
          1⤵
            PID:1416
            • C:\Users\Admin\AppData\Local\Temp\service123.exe
              C:\Users\Admin\AppData\Local\Temp\/service123.exe
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2868

          Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Create or Modify System Process

          1
          T1543

          Windows Service

          1
          T1543.003

          Scheduled Task/Job

          1
          T1053

          Scheduled Task

          1
          T1053.005

          Defense Evasion

          Impair Defenses

          2
          T1562

          Disable or Modify Tools

          2
          T1562.001

          Modify Registry

          4
          T1112

          Subvert Trust Controls

          1
          T1553

          Install Root Certificate

          1
          T1553.004

          Virtualization/Sandbox Evasion

          2
          T1497

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          4
          T1552

          Credentials In Files

          4
          T1552.001

          Discovery

          Query Registry

          5
          T1012

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Virtualization/Sandbox Evasion

          2
          T1497

          Lateral Movement

          Collection

          Data from Local System

          3
          T1005

          Command and Control

          Exfiltration

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
            Filesize

            342B

            MD5

            c7e60d2d460dc8c5c629a6c1dd5b361f

            SHA1

            5f35d964eb3a36c83803f735d89705bdec4df459

            SHA256

            93ec98927a65580b7182a2cb990cecd1bedb651582e5a86deba9a93db19d173e

            SHA512

            3eb3f468fd6feb2890f084d1a1322a8f5be74d8908033f012ac964ae8b25176fed73122e3291b6c993a828139beeecb5349280b471366f41036257abbe156acb

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000002001\gold.exe
            Filesize

            2.5MB

            MD5

            eab5dd4b0d7f9e18d26862b312600f93

            SHA1

            9278a96cff76785646971f8252d70ab14328ee24

            SHA256

            631d8bebaa32e939ece2d304bf739987941cbb4a0e4a1326074e355e508e0c0c

            SHA512

            9efcbdc853b81b0a378e8ea8cf5779edf614b8534970927a68b91be1d6958ea11a63ddd47f132fc6956b53bbe53bda2d0cc143f7b6298f162f8a82e64b75248e

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000004001\legas.exe
            Filesize

            1.4MB

            MD5

            e6d27b60afe69ac02b1eaec864c882ae

            SHA1

            a72b881867b7eaa9187398bd0e9e144af02ffff4

            SHA256

            aac36ff20ea7bfc0591c1d6b145b456bad394ee8e619343ec10d1809188edd75

            SHA512

            4f11fc2b36589fc9ff7dc5afd27cb91614f6a89bfd60942baebef025f53cb56ed7413abeff57fc7c85b3a2a4b0feec2649d5c5a856d3e2e9c13f6a0d8c777764

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000066001\stealc_default2.exe
            Filesize

            307KB

            MD5

            68a99cf42959dc6406af26e91d39f523

            SHA1

            f11db933a83400136dc992820f485e0b73f1b933

            SHA256

            c200ddb7b54f8fa4e3acb6671f5fa0a13d54bd41b978d13e336f0497f46244f3

            SHA512

            7342073378d188912b3e7c6be498055ddf48f04c8def8e87c630c69294bcfd0802280babe8f86b88eaed40e983bcf054e527f457bb941c584b6ea54ad0f0aa75

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000088001\JavUmar1.exe
            Filesize

            6.3MB

            MD5

            83f979357b6142fdb29af934fa314e63

            SHA1

            fe271119b6c4ad30ec35eaaee48ee008718c0be7

            SHA256

            dc26f099c5875a25fab9ed9bf97c941e6e8bb61dcbc67897c2b758e30ad265a3

            SHA512

            443adc54e505fce7acbdd229441605259c89a74c1b1286107e54053a450c0f34f2e8bf282a3b1983c581b86bc71625ab111d48556a2b0e9826869f2883ef61ce

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000089001\stories.exe
            Filesize

            4.1MB

            MD5

            1ebb85ffd5ee9049851b0a6bfab253e1

            SHA1

            9ffb882f1b1d80caf26618bc0cf8d566c4615ab5

            SHA256

            2acf1f6fe11542bb81aaf2ae5fdeca6bf8164be750606c06751eeee56fabe9e0

            SHA512

            5cf23c34b37a79e289af7dacbcbd4a4576f3a21760767d5263592f24b1e3612cb99735c2a4f398126cdb7d438c0c8b571ed6178cf7fdb76847def02dec6567ab

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000336001\num.exe
            Filesize

            307KB

            MD5

            791fcee57312d4a20cc86ae1cea8dfc4

            SHA1

            04a88c60ae1539a63411fe4765e9b931e8d2d992

            SHA256

            27e4a3627d7df2b22189dd4bebc559ae1986d49a8f4e35980b428fadb66cf23d

            SHA512

            2771d4e7b272bf770efad22c9fb1dfafe10cbbf009df931f091fb543e3132c0efda16acb5b515452e9e67e8b1fc8fe8aedd1376c236061385f026865cdc28d2c

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000349001\643f7e502f.exe
            Filesize

            2.8MB

            MD5

            471aa9275d37b291b12f7c4a2538c894

            SHA1

            11ca7fdd156ad1796bf80ebc8b557ef7893ad866

            SHA256

            f6933d8894fd00290ca630063be79875a3b36fba9e9701fd6264237f248a28ee

            SHA512

            e3f836accdea016bc30362b7c316110ad5a1c57d9f58b00ac742d80f4778aefec75020f1cdda3d67e012a5f0f7dc845120ebdaf05ebf81e8619e13575a6e080d

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000354001\375ab19684.exe
            Filesize

            1.8MB

            MD5

            982377c90376c8b5e640fae953893810

            SHA1

            ae570d2da4f5540faa783acf61e7473461e36580

            SHA256

            625b4bcd7767cdeeb837819670e8b0321586f2d45b7259702bdb243e575d0904

            SHA512

            eb9375a14e4d7e1307154810b265084494f422b7c2cc9a248a72bc05f6497eb5351b038ed900d9cf14fe546707406a042fd8405310ac1fe0f396919e31283020

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000355001\eb781d624e.exe
            Filesize

            1.8MB

            MD5

            99f09e8205af264b0f322f12a6891096

            SHA1

            5915bf41c529c77384ef0fb1e19bcb222c3d6e95

            SHA256

            96f5098fafe35a0cc318de14d7c860b37461019be59a85392973424c5f4e34af

            SHA512

            3bd250c00ea025aba9b2d58fdd820967c587dec18d176f0beaaa998ac354e1b35418aca5643fcfd08a875a7c0f220523a16fe3779f12dfa201625ae91e1459b9

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000357001\1dd97d643c.exe
            Filesize

            1.7MB

            MD5

            e0fa22a053db077cd7503ea7d5b8b3ad

            SHA1

            9f1f081213bc02ab522a61c62078b2f7e217f588

            SHA256

            ba4b70d2791b4384209847b6b1856bf9f91130c2c74d054b703b0df508e98888

            SHA512

            67c0288f6c9582cc22c7c5913b300c484c70249f6d2f960c6e3ef4b1dd9109d3998353fd66525cf5cc5ecdad1e6a6d0276f60d01ba580df41ced03ae1ced2122

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000399001\MK.exe
            Filesize

            314KB

            MD5

            ff5afed0a8b802d74af1c1422c720446

            SHA1

            7135acfa641a873cb0c4c37afc49266bfeec91d8

            SHA256

            17ac37b4946539fa7fa68b12bd80946d340497a7971802b5848830ad99ea1e10

            SHA512

            11724d26e11b3146e0fc947c06c59c004c015de0afea24ec28a4eb8145fcd51e9b70007e17621c83f406d9aeb7cd96601245671d41c3fcc88a27c33bd7cf55ac

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000406001\Nework.exe
            Filesize

            416KB

            MD5

            f5d7b79ee6b6da6b50e536030bcc3b59

            SHA1

            751b555a8eede96d55395290f60adc43b28ba5e2

            SHA256

            2f1aff28961ba0ce85ea0e35b8936bc387f84f459a4a1d63d964ce79e34b8459

            SHA512

            532b17cd2a6ac5172b1ddba1e63edd51ab53a4527204415241e3a78e8ffeb9728071bde5ae1eefabefd2627f00963f8a5458668cd7b8df041c8683252ff56b46

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000407001\processclass.exe
            Filesize

            6KB

            MD5

            c042782226565f89ce3954489075e516

            SHA1

            256dd5ba42837a33c7aa6cb71cef33d5617117ee

            SHA256

            a7b63cd9959ac6f23c86644a4ca5411b519855d47f1f5e75a1645d7274f545a6

            SHA512

            9f0771c66ea7c0a2264b99a8782e3ab88a2d74b609265b5ce14f81dcc52b71e46248abd77767018711d72a18e20fe3b272513bfd722fff9043f962f7c8ed93fd

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000409001\splwow64.exe
            Filesize

            1.1MB

            MD5

            ed9393d5765529c845c623e35c1b1a34

            SHA1

            d3eca07f5ce0df847070d2d7fe5253067f624285

            SHA256

            53cd2428c9883acca7182781f22df82c38f8cc115dc014b68e32f8b1cdbf246a

            SHA512

            565f66ef604b10d5be70920d9813e58f5bde174d6a6d30eb8654f467775da8a665c555b7e4127fc22f8a5a5b54466137bde228fd932335517dd017d0ea51f3f8

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\1000448001\stub4141_2024-10-16_03-00.exe
            Filesize

            6KB

            MD5

            307dca9c775906b8de45869cabe98fcd

            SHA1

            2b80c3a2fd4a235b2cc9f89315a554d0721c0dd1

            SHA256

            8437bd0ef46a19c9a7c294c53e0429b40e76ebbd5fe9fd73a9025752495ddb1c

            SHA512

            80c03f7add3a33a5df7b1f1665253283550dac484d26339ecd85672fb506dce44bd0bf96275d5c41a2e7369c3b604de377b7f5985d7d0d76c7ac663d60a67a1c

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\44111dbc49\axplong.exe
            Filesize

            1.8MB

            MD5

            130b282dc6eb40ad9df048de58ac4e96

            SHA1

            2195152ae0ed7102147302131e3c4069df145892

            SHA256

            86b9d17c28f513e6610f028215365d251053d95326a6e2d4dc5d3d84d791887e

            SHA512

            f3106a723038e069c23730b2613c0da43185857d5b2c3b8bc47f637910a961f9fded496ba0181b32499ca82cf1f29695401289d1f5417de33afb839652db6ce1

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\CabF162.tmp
            Filesize

            70KB

            MD5

            49aebf8cbd62d92ac215b2923fb1b9f5

            SHA1

            1723be06719828dda65ad804298d0431f6aff976

            SHA256

            b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

            SHA512

            bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\TarF20F.tmp
            Filesize

            181KB

            MD5

            4ea6026cf93ec6338144661bf1202cd1

            SHA1

            a1dec9044f750ad887935a01430bf49322fbdcb7

            SHA256

            8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

            SHA512

            6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\TmpFD15.tmp
            Filesize

            2KB

            MD5

            1420d30f964eac2c85b2ccfe968eebce

            SHA1

            bdf9a6876578a3e38079c4f8cf5d6c79687ad750

            SHA256

            f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

            SHA512

            6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

            Download Submit

          • C:\Users\Admin\AppData\Roaming\xPW5QW1Nfy.exe
            Filesize

            602KB

            MD5

            e4fc58d334930a9d6572c344e5129f6b

            SHA1

            d38fbd0c4c86eee14722f40cc607e2128c01b00f

            SHA256

            973a9056040af402d6f92f436a287ea164fae09c263f80aba0b8d5366ed9957a

            SHA512

            a69f5da8de8c9782769cca2e2fc5b28bbeba0c0d0027954dbe47b15610d82277abbe912f0e5921a18000f1a3a3c54eb5922f70c773537a22f4b35ff926d17a59

            Download Submit

          • \ProgramData\mozglue.dll
            Filesize

            593KB

            MD5

            c8fd9be83bc728cc04beffafc2907fe9

            SHA1

            95ab9f701e0024cedfbd312bcfe4e726744c4f2e

            SHA256

            ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

            SHA512

            fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

            Download Submit

          • \ProgramData\nss3.dll
            Filesize

            2.0MB

            MD5

            1cc453cdf74f31e4d913ff9c10acdde2

            SHA1

            6e85eae544d6e965f15fa5c39700fa7202f3aafe

            SHA256

            ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

            SHA512

            dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

            Download Submit

          • \Users\Admin\AppData\Roaming\h0mzouAcPy.exe
            Filesize

            393KB

            MD5

            7d7366ab79d6d3d8d83d13a8b30de999

            SHA1

            75c6c49a6701d254c3ce184054a4a01329c1a6f3

            SHA256

            3d66fed04c76d055c6149b33dcfda544b509c57087c57a861e1d6256b59f8465

            SHA512

            64f4551b3be1c21ce7c2d49608463e5aec4166e3e6893883c33a5b7d1109ef0fc8ab6bd15c70d9d606e2706f12a937c2d90d5bc8f6c629ad6f30f212dc25f022

            Download Submit

          • memory/316-178-0x0000000061E00000-0x0000000061EF3000-memory.dmp

            Filesize

            972KB

            Download

          • memory/316-364-0x0000000000FB0000-0x0000000001211000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/316-111-0x0000000000FB0000-0x0000000001211000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/576-567-0x0000000005A00000-0x0000000005CE1000-memory.dmp

            Filesize

            2.9MB

            Download

          • memory/576-710-0x0000000005A00000-0x0000000005CE1000-memory.dmp

            Filesize

            2.9MB

            Download

          • memory/704-590-0x00000000003E0000-0x0000000000836000-memory.dmp

            Filesize

            4.3MB

            Download

          • memory/704-591-0x00000000003E0000-0x0000000000836000-memory.dmp

            Filesize

            4.3MB

            Download

          • memory/1084-36-0x00000000000D0000-0x00000000004AD000-memory.dmp

            Filesize

            3.9MB

            Download

          • memory/1196-476-0x0000000000130000-0x00000000007DE000-memory.dmp

            Filesize

            6.7MB

            Download

          • memory/1196-534-0x0000000000130000-0x00000000007DE000-memory.dmp

            Filesize

            6.7MB

            Download

          • memory/1244-490-0x0000000000800000-0x0000000000CC0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1244-39-0x0000000000800000-0x0000000000CC0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1244-109-0x0000000006180000-0x00000000063E1000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/1244-110-0x0000000006180000-0x00000000063E1000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/1244-112-0x0000000000800000-0x0000000000CC0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1244-363-0x00000000067A0000-0x0000000006C69000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1244-106-0x0000000000800000-0x0000000000CC0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1244-130-0x00000000067A0000-0x0000000006E4E000-memory.dmp

            Filesize

            6.7MB

            Download

          • memory/1244-362-0x0000000000800000-0x0000000000CC0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1244-128-0x00000000067A0000-0x0000000006E4E000-memory.dmp

            Filesize

            6.7MB

            Download

          • memory/1244-76-0x0000000000800000-0x0000000000CC0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1244-105-0x0000000000800000-0x0000000000CC0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1244-21-0x0000000000800000-0x0000000000CC0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1244-22-0x0000000000800000-0x0000000000CC0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1244-175-0x00000000067A0000-0x0000000006C69000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1244-19-0x0000000000800000-0x0000000000CC0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1244-18-0x0000000000801000-0x000000000082F000-memory.dmp

            Filesize

            184KB

            Download

          • memory/1244-306-0x00000000067A0000-0x0000000006E4E000-memory.dmp

            Filesize

            6.7MB

            Download

          • memory/1244-17-0x0000000000800000-0x0000000000CC0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1244-680-0x0000000006180000-0x00000000063E1000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/1244-682-0x0000000006180000-0x00000000063E1000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/1368-245-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

            Filesize

            4KB

            Download

          • memory/1368-247-0x0000000000400000-0x0000000000452000-memory.dmp

            Filesize

            328KB

            Download

          • memory/1368-243-0x0000000000400000-0x0000000000452000-memory.dmp

            Filesize

            328KB

            Download

          • memory/1368-241-0x0000000000400000-0x0000000000452000-memory.dmp

            Filesize

            328KB

            Download

          • memory/1368-239-0x0000000000400000-0x0000000000452000-memory.dmp

            Filesize

            328KB

            Download

          • memory/1368-237-0x0000000000400000-0x0000000000452000-memory.dmp

            Filesize

            328KB

            Download

          • memory/1368-248-0x0000000000400000-0x0000000000452000-memory.dmp

            Filesize

            328KB

            Download

          • memory/1368-246-0x0000000000400000-0x0000000000452000-memory.dmp

            Filesize

            328KB

            Download

          • memory/1600-15-0x0000000001320000-0x00000000017E0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1600-5-0x0000000001320000-0x00000000017E0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1600-0-0x0000000001320000-0x00000000017E0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1600-1-0x0000000077DB0000-0x0000000077DB2000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1600-2-0x0000000001321000-0x000000000134F000-memory.dmp

            Filesize

            184KB

            Download

          • memory/1600-4-0x0000000001320000-0x00000000017E0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1600-3-0x0000000001320000-0x00000000017E0000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/1624-235-0x0000000000190000-0x00000000001E4000-memory.dmp

            Filesize

            336KB

            Download

          • memory/1752-573-0x0000000000E50000-0x0000000000F68000-memory.dmp

            Filesize

            1.1MB

            Download

          • memory/1820-568-0x0000000000400000-0x00000000006E1000-memory.dmp

            Filesize

            2.9MB

            Download

          • memory/2204-89-0x0000000000FF0000-0x000000000108C000-memory.dmp

            Filesize

            624KB

            Download

          • memory/2260-90-0x0000000000990000-0x00000000009F8000-memory.dmp

            Filesize

            416KB

            Download

          • memory/2320-360-0x0000000001310000-0x0000000001428000-memory.dmp

            Filesize

            1.1MB

            Download

          • memory/2320-361-0x0000000009F80000-0x000000000A004000-memory.dmp

            Filesize

            528KB

            Download

          • memory/2360-177-0x0000000000CA0000-0x0000000001169000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/2360-205-0x0000000000CA0000-0x0000000001169000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/2424-456-0x00000000011A0000-0x00000000014A9000-memory.dmp

            Filesize

            3.0MB

            Download

          • memory/2424-575-0x00000000011A0000-0x00000000014A9000-memory.dmp

            Filesize

            3.0MB

            Download

          • memory/2424-571-0x00000000011A0000-0x00000000014A9000-memory.dmp

            Filesize

            3.0MB

            Download

          • memory/2428-131-0x0000000001010000-0x00000000016BE000-memory.dmp

            Filesize

            6.7MB

            Download

          • memory/2428-410-0x0000000001010000-0x00000000016BE000-memory.dmp

            Filesize

            6.7MB

            Download

          • memory/2428-367-0x0000000001010000-0x00000000016BE000-memory.dmp

            Filesize

            6.7MB

            Download

          • memory/2428-337-0x0000000001010000-0x00000000016BE000-memory.dmp

            Filesize

            6.7MB

            Download

          • memory/2448-491-0x0000000000400000-0x0000000000413000-memory.dmp

            Filesize

            76KB

            Download

          • memory/2472-427-0x0000000069CC0000-0x000000006A378000-memory.dmp

            Filesize

            6.7MB

            Download

          • memory/2760-302-0x0000000000DD0000-0x0000000000DD8000-memory.dmp

            Filesize

            32KB

            Download

          • memory/2928-85-0x0000000000400000-0x0000000000531000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2928-60-0x0000000000400000-0x0000000000531000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2928-58-0x0000000000400000-0x0000000000531000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2928-69-0x0000000000400000-0x0000000000531000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2928-70-0x0000000000400000-0x0000000000531000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2928-64-0x0000000000400000-0x0000000000531000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2928-62-0x0000000000400000-0x0000000000531000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2928-71-0x0000000000400000-0x0000000000531000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2928-56-0x0000000000400000-0x0000000000531000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2928-66-0x0000000000400000-0x0000000000531000-memory.dmp

            Filesize

            1.2MB

            Download

          • memory/2928-68-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2956-338-0x0000000006560000-0x00000000067C1000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/2956-570-0x0000000006560000-0x0000000006869000-memory.dmp

            Filesize

            3.0MB

            Download

          • memory/2956-455-0x0000000006560000-0x0000000006869000-memory.dmp

            Filesize

            3.0MB

            Download

          • memory/2956-475-0x0000000006B80000-0x000000000722E000-memory.dmp

            Filesize

            6.7MB

            Download

          • memory/2956-368-0x0000000000220000-0x00000000006E9000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/2956-436-0x0000000000220000-0x00000000006E9000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/2956-454-0x0000000006560000-0x0000000006869000-memory.dmp

            Filesize

            3.0MB

            Download

          • memory/2956-473-0x0000000006B80000-0x000000000722E000-memory.dmp

            Filesize

            6.7MB

            Download

          • memory/2956-206-0x0000000000220000-0x00000000006E9000-memory.dmp

            Filesize

            4.8MB

            Download

          • memory/2956-339-0x0000000006560000-0x00000000067C1000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/2956-698-0x0000000006560000-0x00000000067C1000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/2956-697-0x0000000006560000-0x00000000067C1000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/3052-340-0x0000000000CA0000-0x0000000000F01000-memory.dmp

            Filesize

            2.4MB

            Download

          • memory/3052-437-0x0000000000CA0000-0x0000000000F01000-memory.dmp

            Filesize

            2.4MB

            Download