Overview

overview

10

Static

static

10

2to1ep.exe

windows10-2004-x64

2to1ep.exe

windows11-21h2-x64

10

4363463463...63.exe

windows10-2004-x64

4363463463...63.exe

windows11-21h2-x64

10

Synaptics.exe

windows10-2004-x64

Synaptics.exe

windows11-21h2-x64

10

TsarBomba.exe

windows10-2004-x64

TsarBomba.exe

windows11-21h2-x64

cobaltstri...de.exe

windows10-2004-x64

10

cobaltstri...de.exe

windows11-21h2-x64

10

ed01ebfbc9...aa.exe

windows10-2004-x64

10

ed01ebfbc9...aa.exe

windows11-21h2-x64

10

random.exe

windows10-2004-x64

random.exe

windows11-21h2-x64

10

Resubmissions

18/08/2026, 19:34

260818-x972xsygjb10

02/07/2026, 09:19

260702-labnwsfs6z

29/05/2026, 16:41

260529-t7a3mabx7l

26/05/2026, 03:15

260526-dr1qcadz4y

21/05/2026, 18:13

260521-wt38csgz7110

21/05/2026, 18:04

260521-wnpssagx3s10

21/05/2026, 17:59

260521-wkpzdady5j10

21/05/2026, 17:58

260521-wj9bmady2k

21/05/2026, 17:58

260521-wj5y7sgv4v

21/05/2026, 17:57

260521-wj2lsagv3z

Analysis

  • max time kernel
    599s
  • max time network
    603s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    06/04/2026, 23:44

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    4363463463464363463463463.exe
  • Size 10KB
  • Sample260406-3rdy1set6j
  • SHA256 2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
df2f990b892ca7a21378cd581ca56d4dnrif0lmcollectiondefense_evasiondiscoverylummanjratquasarrhadamanthysrustmevidarinstallerkeyloggerpersistenceprivilege_escalationpyinstallerspywarestealertrojanupx

Malware Config

Extracted

Family

  • vidar

Version

  • 15.5

Botnet

  • df2f990b892ca7a21378cd581ca56d4dn

Campaign

  • rif0lm

C2

  • https://steamcommunity.com/profiles/76561198783900411

  • https://telegram.me/rif0lm

Attributes
  • user_agent

    Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0

Extracted

Family

  • lumma

C2

  • https://houshan.shop

  • https://yunded.com/uwuz

  • https://sirhirssg.su/xzde

  • https://prebwle.su/xazd

  • https://rhussois.su/tatr

  • https://todoexy.su/xqts

  • https://acrislegt.su/tazd

  • https://averiryvx.su/zadr

  • https://cerasatvf.su/qtpd

Attributes
  • build_id

    58482ce51891922bf0aef7e896596263ce2c09f9fec92dbc85

Signatures

  • Detects Rhadamanthys Loader v4.9 and higher 1 IoCs
  • Detects RustMe Keylogger 1 IoCs
  • Detects Vidar Stealer 31 IoCs
    stealer
  • Lumma Stealer, LummaC

    Lumma or LummaC is an infostealer written in C++ first seen in August 2022.

    stealerlumma
  • Lumma family
    lumma
  • Njrat family
    njrat
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar
  • Quasar family
    quasar
  • Quasar payload 2 IoCs
  • Rhadamanthys

    Rhadamanthys is an info stealer written in C++ first seen in August 2022.

    stealerrhadamanthys
  • Rhadamanthys family
    rhadamanthys
  • RustMe Keylogger

    RustMe is a keylogger written in C++.

    keyloggerrustme
  • Rustme family
    rustme
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Vidar family
    vidar
  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat
  • Downloads MZ/PE file 19 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Executes dropped EXE 30 IoCs
  • Loads dropped DLL 54 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 35 IoCs
    collection
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Drops desktop.ini file(s) 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Detects Pyinstaller 2 IoCs
    pyinstaller
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • NSIS installer 4 IoCs
    installer
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Gathers network information 2 TTPs 2 IoCs

    Uses commandline utility to view network configuration.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2748
      • C:\Windows\System32\fontdrvhost.exe
        "C:\Windows\System32\fontdrvhost.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2008
    • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
      "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
      1⤵
      • Downloads MZ/PE file
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4924
      • C:\Users\Admin\AppData\Local\Temp\Files\tomatoleizhutizy.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\tomatoleizhutizy.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:880
      • C:\Users\Admin\AppData\Local\Temp\Files\Round_Setup.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\Round_Setup.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:4084
      • C:\Users\Admin\AppData\Local\Temp\Files\%D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\%D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4696
        • C:\Users\Admin\AppData\Local\Temp\server.exe
          "C:\Users\Admin\AppData\Local\Temp\server.exe"
          3⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1856
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:1480
      • C:\Users\Admin\AppData\Local\Temp\Files\connector1.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\connector1.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:4324
      • C:\Users\Admin\AppData\Local\Temp\Files\BootstrapperNew.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\BootstrapperNew.exe"
        2⤵
        • Executes dropped EXE
        PID:4472
      • C:\Users\Admin\AppData\Local\Temp\Files\agent.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\agent.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:3672
      • C:\Users\Admin\AppData\Local\Temp\Files\hey.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\hey.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3564
      • C:\Users\Admin\AppData\Local\Temp\Files\Discord.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\Discord.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:4348
        • C:\Users\Admin\AppData\Local\Temp\Files\Discord.exe
          "C:\Users\Admin\AppData\Local\Temp\Files\Discord.exe"
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3924
      • C:\Users\Admin\AppData\Local\Temp\Files\oak1.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\oak1.exe"
        2⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:4864
        • C:\Windows\SysWOW64\WScript.exe
          "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\aepk.vbe"
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4976
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c ipconfig /release
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4632
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /release
              5⤵
              • System Location Discovery: System Language Discovery
              • Gathers network information
              PID:1788
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c fmdn.das exjptopdmu.icm
            4⤵
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1144
            • C:\Users\Admin\AppData\Local\Temp\RarSFX0\fmdn.das
              fmdn.das exjptopdmu.icm
              5⤵
              • Executes dropped EXE
              • Adds Run key to start application
              • Suspicious use of SetThreadContext
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2228
              • C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe
                "C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"
                6⤵
                • Executes dropped EXE
                • Accesses Microsoft Outlook profiles
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of WriteProcessMemory
                • outlook_office_path
                • outlook_win_path
                PID:1356
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-fre --no-default-browser-check --no-first-run --no-sandbox --allow-no-sandbox-job --disable-gpu --mute-audio --disable-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak"
                  7⤵
                  • Drops file in Windows directory
                  • Enumerates system info in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of FindShellTrayWindow
                  • Suspicious use of WriteProcessMemory
                  PID:2868
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak\Crashpad --metrics-dir=C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffe7e0dc728,0x7ffe7e0dc734,0x7ffe7e0dc740
                    8⤵
                      PID:4376
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak" --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --metrics-shmem-handle=1592,i,5180899911809310570,17321923024362699468,262144 --field-trial-handle=1948,i,9037073033361988626,10668654475600720383,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
                      8⤵
                        PID:1924
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak" --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1908,i,11004806608544208347,11229476966586074690,524288 --field-trial-handle=1948,i,9037073033361988626,10668654475600720383,262144 --variations-seed-version --mojo-platform-channel-handle=2128 /prefetch:11
                        8⤵
                        • System Time Discovery
                        PID:1964
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak" --force-high-res-timeticks=disabled --metrics-shmem-handle=2180,i,15209989429869398246,13573996064581437733,524288 --field-trial-handle=1948,i,9037073033361988626,10668654475600720383,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:13
                        8⤵
                          PID:2792
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2900,i,6854092977630943228,13719749262477010431,2097152 --field-trial-handle=1948,i,9037073033361988626,10668654475600720383,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:1
                          8⤵
                            PID:4268
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2908,i,7643378930055585891,1608022783702908764,2097152 --field-trial-handle=1948,i,9037073033361988626,10668654475600720383,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:1
                            8⤵
                              PID:4804
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3092,i,14370070769538575720,1390161123357858759,2097152 --field-trial-handle=1948,i,9037073033361988626,10668654475600720383,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
                              8⤵
                                PID:4224
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=3104,i,17104120006448068395,4377879163211569271,2097152 --field-trial-handle=1948,i,9037073033361988626,10668654475600720383,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:9
                                8⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:4724
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak" --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=3840,i,12123997846134544783,7599058645498775013,2097152 --field-trial-handle=1948,i,9037073033361988626,10668654475600720383,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:9
                                8⤵
                                  PID:1808
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak" --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --no-sandbox --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=4180,i,17950230311059451526,7419045906292381793,2097152 --field-trial-handle=1948,i,9037073033361988626,10668654475600720383,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
                                  8⤵
                                    PID:3908
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-sandbox --mute-audio --user-data-dir="C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak" --force-high-res-timeticks=disabled --metrics-shmem-handle=4224,i,9218914876184030279,12726825816501713270,524288 --field-trial-handle=1948,i,9037073033361988626,10668654475600720383,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:14
                                    8⤵
                                      PID:1272
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c ipconfig /renew
                              4⤵
                              • System Location Discovery: System Language Discovery
                              • Suspicious use of WriteProcessMemory
                              PID:556
                              • C:\Windows\SysWOW64\ipconfig.exe
                                ipconfig /renew
                                5⤵
                                • System Location Discovery: System Language Discovery
                                • Gathers network information
                                PID:1736
                        • C:\Users\Admin\AppData\Local\Temp\Files\1488.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files\1488.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious use of WriteProcessMemory
                          PID:3572
                          • C:\Users\Admin\AppData\Local\Temp\Files\1488.exe
                            "C:\Users\Admin\AppData\Local\Temp\Files\1488.exe"
                            3⤵
                            • Executes dropped EXE
                            PID:2680
                        • C:\Users\Admin\AppData\Local\Temp\Files\RustMeDebyg.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files\RustMeDebyg.exe"
                          2⤵
                          • Executes dropped EXE
                          PID:1760
                        • C:\Users\Admin\AppData\Local\Temp\Files\bsg.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files\bsg.exe"
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:4584
                        • C:\Users\Admin\AppData\Local\Temp\Files\2.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files\2.exe"
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2224
                        • C:\Users\Admin\AppData\Local\Temp\Files\World%20of%20Tanks.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files\World%20of%20Tanks.exe"
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:1052
                        • C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe"
                          2⤵
                          • Executes dropped EXE
                          • Drops desktop.ini file(s)
                          PID:2296
                        • C:\Users\Admin\AppData\Local\Temp\Files\billi_e58d74e455634dc695ed8a7b8b320325.exe.dom_2.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files\billi_e58d74e455634dc695ed8a7b8b320325.exe.dom_2.exe"
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:4200
                        • C:\Users\Admin\AppData\Local\Temp\Files\8.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files\8.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of WriteProcessMemory
                          PID:1264
                          • C:\Users\Admin\AppData\Local\Temp\Files\8.exe
                            "C:\Users\Admin\AppData\Local\Temp\Files\8.exe"
                            3⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:1456
                        • C:\Users\Admin\AppData\Local\Temp\Files\doitallmain.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files\doitallmain.exe"
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          PID:3656
                        • C:\Users\Admin\AppData\Local\Temp\Files\IMG001.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files\IMG001.exe"
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of WriteProcessMemory
                          PID:4520
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /c taskkill /f /im tftp.exe & tskill tftp.exe
                            3⤵
                            • System Location Discovery: System Language Discovery
                            • Suspicious use of WriteProcessMemory
                            PID:1056
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /f /im tftp.exe
                              4⤵
                              • System Location Discovery: System Language Discovery
                              • Kills process with taskkill
                              PID:956
                        • C:\Users\Admin\AppData\Local\Temp\Files\Agentnov.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files\Agentnov.exe"
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:1220
                          • C:\Windows\SysWOW64\WScript.exe
                            "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\ComfontwinCrtMonitor\Ay6NG0F6W31r02DmYDfvXlcoXOiJ0g7CZGFgavsjaHVxbb7p79qA9PCcolLF.vbe"
                            3⤵
                            • System Location Discovery: System Language Discovery
                            PID:2804
                        • C:\Users\Admin\AppData\Local\Temp\Files\pieletJF_vm.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files\pieletJF_vm.exe"
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2496
                        • C:\Users\Admin\AppData\Local\Temp\Files\3.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files\3.exe"
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2468
                        • C:\Users\Admin\AppData\Local\Temp\Files\CritScript.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files\CritScript.exe"
                          2⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:2396
                          • C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE
                            "C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE"
                            3⤵
                              PID:1536
                        • C:\Users\Admin\AppData\Local\Temp\server.exe
                          "C:\Users\Admin\AppData\Local\Temp\server.exe" ..
                          1⤵
                          • Executes dropped EXE
                          • System Location Discovery: System Language Discovery
                          PID:1528
                        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
                          1⤵
                            PID:3264
                          • C:\Windows\system32\OpenWith.exe
                            C:\Windows\system32\OpenWith.exe -Embedding
                            1⤵
                              PID:4312

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Command and Scripting Interpreter

                                  1
                                  T1059

                                  Persistence

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Create or Modify System Process

                                  1
                                  T1543

                                  Windows Service

                                  1
                                  T1543.003

                                  Event Triggered Execution

                                  1
                                  T1546

                                  Netsh Helper DLL

                                  1
                                  T1546.007

                                  Privilege Escalation

                                  Boot or Logon Autostart Execution

                                  1
                                  T1547

                                  Registry Run Keys / Startup Folder

                                  1
                                  T1547.001

                                  Create or Modify System Process

                                  1
                                  T1543

                                  Windows Service

                                  1
                                  T1543.003

                                  Event Triggered Execution

                                  1
                                  T1546

                                  Netsh Helper DLL

                                  1
                                  T1546.007

                                  Defense Evasion

                                  Impair Defenses

                                  1
                                  T1562

                                  Disable or Modify System Firewall

                                  1
                                  T1562.004

                                  Modify Registry

                                  1
                                  T1112

                                  Credential Access

                                  Credentials from Password Stores

                                  1
                                  T1555

                                  Credentials from Web Browsers

                                  1
                                  T1555.003

                                  Unsecured Credentials

                                  2
                                  T1552

                                  Credentials In Files

                                  1
                                  T1552.001

                                  Credentials in Registry

                                  1
                                  T1552.002

                                  Discovery

                                  Browser Information Discovery

                                  1
                                  T1217

                                  Query Registry

                                  1
                                  T1012

                                  System Information Discovery

                                  3
                                  T1082

                                  System Location Discovery

                                  1
                                  T1614

                                  System Language Discovery

                                  1
                                  T1614.001

                                  System Time Discovery

                                  1
                                  T1124

                                  Lateral Movement

                                  Collection

                                  Data from Local System

                                  2
                                  T1005

                                  Email Collection

                                  1
                                  T1114

                                  Command and Control

                                  Web Service

                                  1
                                  T1102

                                  Exfiltration

                                  Impact

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  %D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\%D0%A4%D0%BE%D1%80%D0%BC%D0%B0%203%D0%9E%D0%A8%D0%91%D0%A0.exe
                                  • Size 23KB
                                  • SHA256 d722015dcef7d2865e94a180b99fbc57e22931d771fa97c8d336e667bc027008
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  02.08.2022.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\02.08.2022.exe
                                  • Size 283KB
                                  • SHA256 592aca59fae9dc1c3443ac7faefb7d49b868eefad944c9a8b79e3764e2951196
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  1488.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\1488.exe
                                  • Size 2.6MB
                                  • SHA256 a52a3ef569a127cae0b891c9b722a723a05709c3fc3f9100bcf8b2166ea5cc0a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  2.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\2.exe
                                  • Size 18KB
                                  • SHA256 0a5a72cc1d69e1f0c6113c84e634e9b9c82b8e7bc9d05b6732da3a4f5d81761d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  3.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\3.exe
                                  • Size 18KB
                                  • SHA256 39c064b7e80aed53c6dd9eb06207b9cbd334a63b83e2fd5ead7727005a12a3b6
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  8.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\8.exe
                                  • Size 9.0MB
                                  • SHA256 831fd93f76c7e8dc702ac517de7b7dec48670c938138be2a53efd16563deddbf
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Agentnov.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\Agentnov.exe
                                  • Size 1.9MB
                                  • SHA256 32f09dd71d1233a91be0ddf9bd128aa5ad8cee87ecbcf6f0c56762c8e4d8386f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  BootstrapperNew.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\BootstrapperNew.exe
                                  • Size 2.9MB
                                  • SHA256 cb5d6c1ca0aa6232a2d55e14b20ac4a9945a0bd063c57d60a5ed3ae94160e3e8
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Client-built.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\Client-built.exe
                                  • Size 232B
                                  • SHA256 54e3bc32dfbd5730ebe5ae40922242cc2707c42c08fc0fb4ccdf04644855c86d
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  CritScript.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\CritScript.exe
                                  • Size 3.2MB
                                  • SHA256 1b701daded4124260a49040d83dec15c627b8e4a1a04dc378aae7fecfca3abf3
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Discord.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\Discord.exe
                                  • Size 9.5MB
                                  • SHA256 afb65677bb4f2cd74be4b51cdd838bb647c5513a81b4280b1953105f5c063cc8
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  IMG001.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\IMG001.exe
                                  • Size 3.4MB
                                  • SHA256 b21cc3afe552b093b598fc93a023897acd91ebcb8dc045f16463962dcfacf9d0
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Round_Setup.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\Round_Setup.exe
                                  • Size 4.1MB
                                  • SHA256 80de269730b6f243a049247d50871957b669ecd637b9b50d5270aaf1a3c79709
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  RustMeDebyg.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\RustMeDebyg.exe
                                  • Size 1.8MB
                                  • SHA256 134ab75c12eb962a0c3be3439d72175926a9b7697ea73f0a695173d237f730bd
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  World%20of%20Tanks.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\World%20of%20Tanks.exe
                                  • Size 72KB
                                  • SHA256 1d728a4c330add4b8a4196e1d698fd4c857a004ed5b51e5b97c6ddd5eb671490
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  agent.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\agent.exe
                                  • Size 6.0MB
                                  • SHA256 3e88c306194019cb3aeb0407b46f208dd14c3aabdcc28e8fb5e782670ce87b90
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  billi_e58d74e455634dc695ed8a7b8b320325.exe.dom_2.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\billi_e58d74e455634dc695ed8a7b8b320325.exe.dom_2.exe
                                  • Size 72KB
                                  • SHA256 03e9d40b1a4fe605b9830af70bc6f3368a5b2ad308e518640275c8b312c6ebce
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  bsg.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\bsg.exe
                                  • Size 1.6MB
                                  • SHA256 d56e5881ddfb6adf33a9554fece06ff43aae92ee269019a1d8dac7ed764d97d7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  connector1.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\connector1.exe
                                  • Size 72KB
                                  • SHA256 3c3ce0355bfa42b379830b93a76cffd32fceed54e6b549ae4a1132ca30b392ff
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  deviceid.txt
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\deviceid.txt
                                  • Size 36B
                                  • SHA256 864b9a22bbc7e9e94fb0d4a6d7489b70d2a0ce7728643ac9d7e340630549506b
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  doitallmain.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\doitallmain.exe
                                  • Size 1.4MB
                                  • SHA256 4be75a1f4949de392b98b2a2ab16a469c20bb494bd34f23c270ef9bec086ced7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  hey.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\hey.exe
                                  • Size 62KB
                                  • SHA256 a961ce0314f78900f26aec189234ac71e497487b35c1a4a604bf384e911f3e00
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  oak1.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\oak1.exe
                                  • Size 1.4MB
                                  • SHA256 e73fa583da7adc97a772826ce26e16ed0b95e4193a36382a2e69e148fbd4dea1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  pieletJF_vm.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\pieletJF_vm.exe
                                  • Size 272KB
                                  • SHA256 bed76b617a0dd97871dccc90d1b52c1760be066aabda67990308b22c29877a16
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  svchost.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\svchost.exe
                                  • Size 164KB
                                  • SHA256 115eb84390be11a5cbd396a9b950fcbe799e1684d0a6995ada7bca184fffba8f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  tomatoleizhutizy.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\tomatoleizhutizy.exe
                                  • Size 17.3MB
                                  • SHA256 c36ef60d2ebc56fa0b54fec3ecaad1a407342fde4eae4d279000942a3c695368
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  xrUHBmzvLAgHfnQCerRv.exe
                                  • Path C:\Users\Admin\AppData\Local\Temp\Files\xrUHBmzvLAgHfnQCerRv.exe
                                  • Size 411B
                                  • SHA256 f80dc39bb3b7ae017bc2d0ab465c814c1c1ac5b12c5fd4e0c559dbc76afe82ff
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  JUSCHED.EXE
                                  • Path C:\Users\Admin\AppData\Local\Temp\JUSCHED.EXE
                                  • Size 3.1MB
                                  • SHA256 902bea9e4aeeed4e0b5d30a9cbcc6f9f1fc687b79c3fdde8258b94b410d1797a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  uxusoaaldn.das
                                  • Path C:\Users\Admin\AppData\Local\Temp\RarSFX0\uxusoaaldn.das
                                  • Size 39KB
                                  • SHA256 dc6c9fc931fe996427b58493bd0acda8b2979e26180e663eea866f8d0efe35ea
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  VCRUNTIME140.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\VCRUNTIME140.dll
                                  • Size 94KB
                                  • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _asyncio.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_asyncio.pyd
                                  • Size 31KB
                                  • SHA256 40e7d16df4da163f5aa85f35a195e4c7ce24ac5694e401346c2ec0a1df7bc601
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _bz2.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_bz2.pyd
                                  • Size 43KB
                                  • SHA256 6f941039f9b458af12f44d077c149e64f2ff5111d4cd252e05388628e9fe54fb
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _ctypes.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_ctypes.pyd
                                  • Size 53KB
                                  • SHA256 76bb738f65e6d34d8da83694d71e7cb942ce362a1b6ee0515a145487fec59a1d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _hashlib.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_hashlib.pyd
                                  • Size 30KB
                                  • SHA256 7871ba8e0a2e62cbf67b3c325856f3a6c184244f4ea182ca4d37df71e3579372
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _lzma.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_lzma.pyd
                                  • Size 81KB
                                  • SHA256 346ec5f471a698c200c639e4fbf1759ba270dc36cb2ea92cad70f18f735b872f
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _overlapped.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_overlapped.pyd
                                  • Size 27KB
                                  • SHA256 b9152a381ffd9722fc9d61569e183659f1f20074926f44d4626db1fa82baa326
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _queue.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_queue.pyd
                                  • Size 21KB
                                  • SHA256 966290bf95a66fcf81617f5e59ee218ca4a37a0160fe9a05dd4a8028a08e70ea
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _socket.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_socket.pyd
                                  • Size 38KB
                                  • SHA256 c762d81610a4163a40724e1ef13fa9c07acc99bec928ad90d1a27705df477e98
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _sqlite3.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_sqlite3.pyd
                                  • Size 45KB
                                  • SHA256 0e643e3d5a9103983648b4cb15691fbcff446e9cdd3ffbc809ddc62600ac769c
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _ssl.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\_ssl.pyd
                                  • Size 57KB
                                  • SHA256 6f080de35210710561ca59edf39ee23833913fbdf6124c75d01397ac56e93368
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  base_library.zip
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\base_library.zip
                                  • Size 1.0MB
                                  • SHA256 12ddc00bbb7279e0ab09deca714e7c873662d00406b324d4032bb11720ffa107
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  md.cp310-win_amd64.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\charset_normalizer\md.cp310-win_amd64.pyd
                                  • Size 9KB
                                  • SHA256 fc2efb707b3bb9e2cc797131832cb44459ab4e6729ea1092f4ef7bf6eb51f35d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  libcrypto-1_1.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\libcrypto-1_1.dll
                                  • Size 1.1MB
                                  • SHA256 16a844c815b485bab5a705ae2dca11d7c24e6ac84649d506ee0b0a0302233c90
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  libffi-7.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\libffi-7.dll
                                  • Size 23KB
                                  • SHA256 85ac46f9d1fd15ab12f961e51ba281bff8c0141fa122bfa21a66e13dd4f943e7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  libssl-1_1.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\libssl-1_1.dll
                                  • Size 198KB
                                  • SHA256 c414891850a20ce9df7cf6739ec3fa8a57d1a2c711e1d246dc137ef3f58dd377
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  _psutil_windows.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\psutil\_psutil_windows.pyd
                                  • Size 34KB
                                  • SHA256 4b3b5d15d13a96e3643a7be25cf6135d1a2fd13f41f6431239e0fa89b0d2ed7a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  python3.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\python3.dll
                                  • Size 60KB
                                  • SHA256 8d5e09791b8b251676e16bdd66a7118d88b10b66ad80a87d5897fadbefb91790
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  python310.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\python310.dll
                                  • Size 1.4MB
                                  • SHA256 de05a58247136d07970b5d3a0582143833e397abfb9ba22e36fcae99f4c7c66d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  select.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\select.pyd
                                  • Size 21KB
                                  • SHA256 37825176b35ba6835f779dedcf1bafd5b84ae05b525002811d7b30cd8d8fdc61
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  sqlite3.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\sqlite3.dll
                                  • Size 605KB
                                  • SHA256 b150b2871e9bdbe48ec391d7d968b7a0ec307e47df82520e238497afa9e2eeff
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  unicodedata.pyd
                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI43482\unicodedata.pyd
                                  • Size 285KB
                                  • SHA256 57dfc216e9d0b94a8426ca3b49a1d0be4ffec672330d9092b1875571a202e99d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  aepk.vbe
                                  • Path C:\Users\Admin\AppData\Local\Temp\docm\aepk.vbe
                                  • Size 187KB
                                  • SHA256 b89cd68e179271bb5324dea60a24b4f4638fe01577ef4f93fce3dea9040e2391
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  fmdn.das
                                  • Path C:\Users\Admin\AppData\Local\Temp\docm\fmdn.das
                                  • Size 925KB
                                  • SHA256 98e4f904f7de1644e519d09371b8afcbbf40ff3bd56d76ce4df48479a4ab884b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  SCT Auditing Pending Reports
                                  • Path C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak\Default\Network\SCT Auditing Pending Reports
                                  • Size 2B
                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  CURRENT
                                  • Path C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak\Default\shared_proto_db\metadata\CURRENT
                                  • Size 16B
                                  • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  MANIFEST-000001
                                  • Path C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak\Default\shared_proto_db\metadata\MANIFEST-000001
                                  • Size 41B
                                  • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  data_0
                                  • Path C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak\GrShaderCache\data_0
                                  • Size 8KB
                                  • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_2
                                  • Path C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak\GrShaderCache\data_2
                                  • Size 8KB
                                  • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_3
                                  • Path C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak\GrShaderCache\data_3
                                  • Size 8KB
                                  • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  data_1
                                  • Path C:\Users\Admin\AppData\Local\Temp\kkkgd00n.iak\GraphiteDawnCache\data_1
                                  • Size 264KB
                                  • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                                  • MD5 SHA1 SHA512 SSDEEP
                                  Submit Download

                                  InstallOptions.dll
                                  • Path C:\Users\Admin\AppData\Local\Temp\nsw2C58.tmp\InstallOptions.dll
                                  • Size 14KB
                                  • SHA256 21042be362d4073053bffcc90511b3ecf77902243525b56bb159581b5ece43a0
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  ioSpecial.ini
                                  • Path C:\Users\Admin\AppData\Local\Temp\nsw2C58.tmp\ioSpecial.ini
                                  • Size 749B
                                  • SHA256 0670bdfbf0169e1329563c24e718c24b635d21cf5a5b3d2754b6aacd2b9e83b8
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  memory/1356-724-0x0000000001360000-0x00000000018DD000-memory.dmp
                                  Download

                                  memory/1480-145-0x0000000002AC0000-0x0000000002AD9000-memory.dmp
                                  Download

                                  memory/2008-144-0x00007FFEA6550000-0x00007FFEA68C4000-memory.dmp
                                  Download

                                  memory/2008-142-0x00007FFEA8DA0000-0x00007FFEA8FA9000-memory.dmp
                                  Download

                                  memory/2008-143-0x00007FFEA7640000-0x00007FFEA76FD000-memory.dmp
                                  Download

                                  memory/2008-141-0x0000025CC3110000-0x0000025CC3510000-memory.dmp
                                  Download

                                  memory/2008-138-0x0000025CC2E50000-0x0000025CC2E5A000-memory.dmp
                                  Download

                                  memory/2008-147-0x0000025CC53C0000-0x0000025CC53F7000-memory.dmp
                                  Download

                                  memory/2680-954-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-1012-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-934-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-930-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-927-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-925-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-924-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-914-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-902-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-936-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-938-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-948-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-949-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-951-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-1036-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-982-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-1006-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-935-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-734-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-1019-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-1024-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-730-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-1025-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-1027-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-613-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-727-0x000001A04D920000-0x000001A04D92C000-memory.dmp
                                  Download

                                  memory/2680-1031-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-1034-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-643-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-623-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-615-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/2680-614-0x0000000140000000-0x000000014006F000-memory.dmp
                                  Download

                                  memory/3564-232-0x0000000000DE0000-0x0000000000DF4000-memory.dmp
                                  Download

                                  memory/3564-491-0x0000000001830000-0x000000000183C000-memory.dmp
                                  Download

                                  memory/3924-386-0x00007FFE9CAA0000-0x00007FFE9CAB9000-memory.dmp
                                  Download

                                  memory/3924-412-0x00007FFE97A20000-0x00007FFE97A2C000-memory.dmp
                                  Download

                                  memory/3924-415-0x00007FFE97970000-0x00007FFE9797B000-memory.dmp
                                  Download

                                  memory/3924-414-0x00007FFE979C0000-0x00007FFE979CB000-memory.dmp
                                  Download

                                  memory/3924-413-0x00007FFE97A10000-0x00007FFE97A1C000-memory.dmp
                                  Download

                                  memory/3924-411-0x00007FFE97A30000-0x00007FFE97A3E000-memory.dmp
                                  Download

                                  memory/3924-410-0x00007FFE97A40000-0x00007FFE97A4D000-memory.dmp
                                  Download

                                  memory/3924-409-0x00007FFE97A50000-0x00007FFE97A5C000-memory.dmp
                                  Download

                                  memory/3924-408-0x00007FFE83270000-0x00007FFE83388000-memory.dmp
                                  Download

                                  memory/3924-407-0x00007FFE97A60000-0x00007FFE97A6B000-memory.dmp
                                  Download

                                  memory/3924-406-0x00007FFE97F60000-0x00007FFE97F6C000-memory.dmp
                                  Download

                                  memory/3924-405-0x00007FFE98710000-0x00007FFE9872E000-memory.dmp
                                  Download

                                  memory/3924-404-0x00007FFE97F70000-0x00007FFE97F7B000-memory.dmp
                                  Download

                                  memory/3924-403-0x00007FFE97FF0000-0x00007FFE97FFB000-memory.dmp
                                  Download

                                  memory/3924-402-0x00007FFE97FE0000-0x00007FFE97FEC000-memory.dmp
                                  Download

                                  memory/3924-401-0x00007FFE98190000-0x00007FFE9819B000-memory.dmp
                                  Download

                                  memory/3924-400-0x00007FFE81110000-0x00007FFE8127D000-memory.dmp
                                  Download

                                  memory/3924-398-0x00007FFE981A0000-0x00007FFE981E5000-memory.dmp
                                  Download

                                  memory/3924-394-0x00007FFE983A0000-0x00007FFE983C5000-memory.dmp
                                  Download

                                  memory/3924-393-0x00007FFE98450000-0x00007FFE9845B000-memory.dmp
                                  Download

                                  memory/3924-392-0x00007FFE98700000-0x00007FFE9870D000-memory.dmp
                                  Download

                                  memory/3924-397-0x00007FFE814E0000-0x00007FFE81854000-memory.dmp
                                  Download

                                  memory/3924-423-0x00007FFE81860000-0x00007FFE81CC5000-memory.dmp
                                  Download

                                  memory/3924-452-0x00007FFE9D1F0000-0x00007FFE9D209000-memory.dmp
                                  Download

                                  memory/3924-471-0x00007FFE97FE0000-0x00007FFE97FEC000-memory.dmp
                                  Download

                                  memory/3924-470-0x00007FFE98190000-0x00007FFE9819B000-memory.dmp
                                  Download

                                  memory/3924-469-0x00007FFE97FF0000-0x00007FFE97FFB000-memory.dmp
                                  Download

                                  memory/3924-468-0x00007FFE814E0000-0x00007FFE81854000-memory.dmp
                                  Download

                                  memory/3924-467-0x00007FFE983A0000-0x00007FFE983C5000-memory.dmp
                                  Download

                                  memory/3924-466-0x00007FFE98450000-0x00007FFE9845B000-memory.dmp
                                  Download

                                  memory/3924-465-0x00007FFE98700000-0x00007FFE9870D000-memory.dmp
                                  Download

                                  memory/3924-464-0x00007FFE983D0000-0x00007FFE983EC000-memory.dmp
                                  Download

                                  memory/3924-463-0x00007FFE98000000-0x00007FFE9802F000-memory.dmp
                                  Download

                                  memory/3924-462-0x00007FFE984B0000-0x00007FFE984C5000-memory.dmp
                                  Download

                                  memory/3924-461-0x00007FFE97A40000-0x00007FFE97A4D000-memory.dmp
                                  Download

                                  memory/3924-460-0x00007FFE98710000-0x00007FFE9872E000-memory.dmp
                                  Download

                                  memory/3924-458-0x00007FFE9C860000-0x00007FFE9C874000-memory.dmp
                                  Download

                                  memory/3924-457-0x00007FFE8E3D0000-0x00007FFE8E486000-memory.dmp
                                  Download

                                  memory/3924-456-0x00007FFE97F70000-0x00007FFE97F7B000-memory.dmp
                                  Download

                                  memory/3924-455-0x00007FFEA0530000-0x00007FFEA053D000-memory.dmp
                                  Download

                                  memory/3924-454-0x00007FFE9CAA0000-0x00007FFE9CAB9000-memory.dmp
                                  Download

                                  memory/3924-453-0x00007FFE9CAC0000-0x00007FFE9CAEC000-memory.dmp
                                  Download

                                  memory/3924-451-0x00007FFE9C9D0000-0x00007FFE9C9FE000-memory.dmp
                                  Download

                                  memory/3924-450-0x00007FFE9D210000-0x00007FFE9D234000-memory.dmp
                                  Download

                                  memory/3924-449-0x00007FFEA1EC0000-0x00007FFEA1ECF000-memory.dmp
                                  Download

                                  memory/3924-424-0x000001F5C4B50000-0x000001F5C4B5C000-memory.dmp
                                  Download

                                  memory/3924-459-0x00007FFE981A0000-0x00007FFE981E5000-memory.dmp
                                  Download

                                  memory/3924-417-0x00007FFE975F0000-0x00007FFE975FC000-memory.dmp
                                  Download

                                  memory/3924-322-0x00007FFE81860000-0x00007FFE81CC5000-memory.dmp
                                  Download

                                  memory/3924-345-0x00007FFE9D1F0000-0x00007FFE9D209000-memory.dmp
                                  Download

                                  memory/3924-419-0x00007FFE915A0000-0x00007FFE915B2000-memory.dmp
                                  Download

                                  memory/3924-362-0x00007FFE8E3D0000-0x00007FFE8E486000-memory.dmp
                                  Download

                                  memory/3924-363-0x00007FFE814E0000-0x00007FFE81854000-memory.dmp
                                  Download

                                  memory/3924-361-0x00007FFE81860000-0x00007FFE81CC5000-memory.dmp
                                  Download

                                  memory/3924-357-0x00007FFE9C9D0000-0x00007FFE9C9FE000-memory.dmp
                                  Download

                                  memory/3924-421-0x00007FFE7F530000-0x00007FFE7F780000-memory.dmp
                                  Download

                                  memory/3924-422-0x00007FFE91560000-0x00007FFE9158B000-memory.dmp
                                  Download

                                  memory/3924-420-0x00007FFE91590000-0x00007FFE9159C000-memory.dmp
                                  Download

                                  memory/3924-418-0x00007FFE96F70000-0x00007FFE96F7D000-memory.dmp
                                  Download

                                  memory/3924-416-0x00007FFE97830000-0x00007FFE9783C000-memory.dmp
                                  Download

                                  memory/3924-399-0x00007FFE98000000-0x00007FFE9802F000-memory.dmp
                                  Download

                                  memory/3924-356-0x00007FFEA0530000-0x00007FFEA053D000-memory.dmp
                                  Download

                                  memory/3924-351-0x00007FFE9CAA0000-0x00007FFE9CAB9000-memory.dmp
                                  Download

                                  memory/3924-348-0x00007FFE9CAC0000-0x00007FFE9CAEC000-memory.dmp
                                  Download

                                  memory/3924-342-0x00007FFEA1EC0000-0x00007FFEA1ECF000-memory.dmp
                                  Download

                                  memory/3924-341-0x00007FFE9D210000-0x00007FFE9D234000-memory.dmp
                                  Download

                                  memory/3924-369-0x00007FFE9C860000-0x00007FFE9C874000-memory.dmp
                                  Download

                                  memory/3924-395-0x00007FFE9C9D0000-0x00007FFE9C9FE000-memory.dmp
                                  Download

                                  memory/3924-396-0x00007FFE8E3D0000-0x00007FFE8E486000-memory.dmp
                                  Download

                                  memory/3924-387-0x00007FFE983D0000-0x00007FFE983EC000-memory.dmp
                                  Download

                                  memory/3924-380-0x00007FFE984B0000-0x00007FFE984C5000-memory.dmp
                                  Download

                                  memory/3924-381-0x00007FFE83270000-0x00007FFE83388000-memory.dmp
                                  Download

                                  memory/3924-370-0x00007FFE99220000-0x00007FFE99230000-memory.dmp
                                  Download

                                  memory/3924-374-0x00007FFE98710000-0x00007FFE9872E000-memory.dmp
                                  Download

                                  memory/3924-375-0x00007FFE81110000-0x00007FFE8127D000-memory.dmp
                                  Download

                                  memory/4084-134-0x000001FC46690000-0x000001FC46A90000-memory.dmp
                                  Download

                                  memory/4084-139-0x00007FF7B1710000-0x00007FF7B1B2F000-memory.dmp
                                  Download

                                  memory/4084-137-0x00007FFEA6550000-0x00007FFEA68C4000-memory.dmp
                                  Download

                                  memory/4084-133-0x000001FC46690000-0x000001FC46A90000-memory.dmp
                                  Download

                                  memory/4084-135-0x00007FFEA8DA0000-0x00007FFEA8FA9000-memory.dmp
                                  Download

                                  memory/4084-130-0x000001FC46570000-0x000001FC4668E000-memory.dmp
                                  Download

                                  memory/4084-131-0x000001FC2C090000-0x000001FC2C098000-memory.dmp
                                  Download

                                  memory/4084-132-0x000001FC2C0A0000-0x000001FC2C0B0000-memory.dmp
                                  Download

                                  memory/4084-136-0x00007FFEA7640000-0x00007FFEA76FD000-memory.dmp
                                  Download

                                  memory/4472-191-0x00000199E33B0000-0x00000199E33C0000-memory.dmp
                                  Download

                                  memory/4472-196-0x0000019982350000-0x000001998235A000-memory.dmp
                                  Download

                                  memory/4472-218-0x00000199E3360000-0x00000199E336C000-memory.dmp
                                  Download

                                  memory/4472-192-0x00000199FFA30000-0x00000199FFA38000-memory.dmp
                                  Download

                                  memory/4472-202-0x00000199FFA50000-0x00000199FFA58000-memory.dmp
                                  Download

                                  memory/4472-193-0x00000199FFEA0000-0x00000199FFED8000-memory.dmp
                                  Download

                                  memory/4472-201-0x0000019982360000-0x000001998236A000-memory.dmp
                                  Download

                                  memory/4472-200-0x00000199823A0000-0x00000199823AA000-memory.dmp
                                  Download

                                  memory/4472-194-0x00000199FFA40000-0x00000199FFA4E000-memory.dmp
                                  Download

                                  memory/4472-195-0x0000019982250000-0x0000019982350000-memory.dmp
                                  Download

                                  memory/4472-199-0x00000199823C0000-0x00000199823D6000-memory.dmp
                                  Download

                                  memory/4472-197-0x0000019982370000-0x0000019982396000-memory.dmp
                                  Download

                                  memory/4472-190-0x00000199E2C60000-0x00000199E2F42000-memory.dmp
                                  Download

                                  memory/4472-198-0x00000199823B0000-0x00000199823B8000-memory.dmp
                                  Download

                                  memory/4584-920-0x0000000002DE0000-0x0000000002E44000-memory.dmp
                                  Download

                                  memory/4584-904-0x0000000002DE0000-0x0000000002E44000-memory.dmp
                                  Download

                                  memory/4696-129-0x000000006F310000-0x000000006F8C1000-memory.dmp
                                  Download

                                  memory/4696-117-0x000000006F311000-0x000000006F312000-memory.dmp
                                  Download

                                  memory/4696-118-0x000000006F310000-0x000000006F8C1000-memory.dmp
                                  Download

                                  memory/4924-508-0x00000000057A0000-0x0000000005861000-memory.dmp
                                  Download

                                  memory/4924-3-0x00000000057A0000-0x0000000005861000-memory.dmp
                                  Download

                                  memory/4924-1-0x0000000005890000-0x000000000592C000-memory.dmp
                                  Download

                                  memory/4924-611-0x00000000057A0000-0x0000000005861000-memory.dmp
                                  Download

                                  memory/4924-2-0x0000000005AE0000-0x0000000005AF0000-memory.dmp
                                  Download

                                  memory/4924-189-0x00000000057A0000-0x0000000005861000-memory.dmp
                                  Download

                                  memory/4924-119-0x00000000057A0000-0x0000000005861000-memory.dmp
                                  Download

                                  memory/4924-156-0x00000000057A0000-0x0000000005861000-memory.dmp
                                  Download

                                  memory/4924-174-0x00000000057A0000-0x0000000005861000-memory.dmp
                                  Download

                                  memory/4924-0-0x0000000000DD0000-0x0000000000DD8000-memory.dmp
                                  Download

                                  memory/4924-4-0x0000000005AE0000-0x0000000005AF0000-memory.dmp
                                  Download

                                  memory/4976-712-0x0000000003420000-0x000000000350A000-memory.dmp
                                  Download

                                  memory/4976-704-0x00000000037B0000-0x00000000037C8000-memory.dmp
                                  Download

                                  memory/4976-703-0x0000000003420000-0x000000000350A000-memory.dmp
                                  Download

                                  memory/4976-713-0x00000000037B0000-0x00000000037C8000-memory.dmp
                                  Download