blankgrabber | a5851f86927ab2cb26b54e12bc27e41e1348617140e026af00ddc574f76d9bcb

Analysis

max time kernel
149s
max time network
121s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_3546bbcc5980f97f549eb93bbd824d19_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
Size 8.1MB
Sample260423-ql8j8aex2z
SHA256 a5851f86927ab2cb26b54e12bc27e41e1348617140e026af00ddc574f76d9bcb
MD5 3546bbcc5980f97f549eb93bbd824d19
SHA1 24be74172a158a5210c5a67047a76b5e4d8de177
SHA512 b6b31f0bc9c0f75dcac394a754e4504f8c6acb4540c590a8565078b5ee19c853a3b507f0b7c1af38526348ff606631f4533fd1735014e02e0ea90e8d050c5813
SSDEEP 196608:FrelyVLXO3Rs3AklKMB1akvcErhJJ06G+dQJja0X6rv8BLG:h4yZXOBjrMBXvcErhY61qJu0QMi
TLSH
T1F1863366A2E195E5CC77C47C5091072BF7B0FC2843259AEB1784C2D9DE26AC21F39B93
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion blankgrabber spyware stealer

Malware Config

Signatures

Family: blankgrabber
Blankgrabber is an infostealer written in Python and packaged with Pyinstaller.
stealer blankgrabber

A stealer written in Python and packaged with Pyinstaller 1 IoCs

resource	yara_rule
behavioral2/files/0x002400000002b24f-43.dat	blankgrabber_exe

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x002400000002b24f-43.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Custom signature

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/files/0x002400000002b24f-43.dat	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Custom signature

Detects executables referencing many confidential data stores found in browsers, mail clients, crypt 1 IoCs

resource	yara_rule
behavioral2/files/0x002400000002b24f-43.dat	INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store

Custom signature

Detects executables using Telegram Chat Bot 1 IoCs

resource	yara_rule
behavioral2/files/0x002400000002b24f-43.dat	INDICATOR_SUSPICIOUS_EXE_TelegramChatBot

Executes dropped EXE 1 IoCs

pid	Process
4276	Built.exe

Loads dropped DLL 30 IoCs

pid	Process
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe
4276	Built.exe

Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Hide Artifacts: Ignore Process Interrupts 1 TTPs 3 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
1244	powershell.exe
2400	powershell.exe
2680	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1244	powershell.exe
2400	powershell.exe
1244	powershell.exe
2400	powershell.exe
1244	powershell.exe
2400	powershell.exe
2680	powershell.exe
2680	powershell.exe
2680	powershell.exe

Suspicious use of AdjustPrivilegeToken 45 IoCs

description	pid	Process
Token: SeDebugPrivilege	1244	powershell.exe
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	2680	powershell.exe
Token: SeIncreaseQuotaPrivilege	1540	WMIC.exe
Token: SeSecurityPrivilege	1540	WMIC.exe
Token: SeTakeOwnershipPrivilege	1540	WMIC.exe
Token: SeLoadDriverPrivilege	1540	WMIC.exe
Token: SeSystemProfilePrivilege	1540	WMIC.exe
Token: SeSystemtimePrivilege	1540	WMIC.exe
Token: SeProfSingleProcessPrivilege	1540	WMIC.exe
Token: SeIncBasePriorityPrivilege	1540	WMIC.exe
Token: SeCreatePagefilePrivilege	1540	WMIC.exe
Token: SeBackupPrivilege	1540	WMIC.exe
Token: SeRestorePrivilege	1540	WMIC.exe
Token: SeShutdownPrivilege	1540	WMIC.exe
Token: SeDebugPrivilege	1540	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1540	WMIC.exe
Token: SeRemoteShutdownPrivilege	1540	WMIC.exe
Token: SeUndockPrivilege	1540	WMIC.exe
Token: SeManageVolumePrivilege	1540	WMIC.exe
Token: 33	1540	WMIC.exe
Token: 34	1540	WMIC.exe
Token: 35	1540	WMIC.exe
Token: 36	1540	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1540	WMIC.exe
Token: SeSecurityPrivilege	1540	WMIC.exe
Token: SeTakeOwnershipPrivilege	1540	WMIC.exe
Token: SeLoadDriverPrivilege	1540	WMIC.exe
Token: SeSystemProfilePrivilege	1540	WMIC.exe
Token: SeSystemtimePrivilege	1540	WMIC.exe
Token: SeProfSingleProcessPrivilege	1540	WMIC.exe
Token: SeIncBasePriorityPrivilege	1540	WMIC.exe
Token: SeCreatePagefilePrivilege	1540	WMIC.exe
Token: SeBackupPrivilege	1540	WMIC.exe
Token: SeRestorePrivilege	1540	WMIC.exe
Token: SeShutdownPrivilege	1540	WMIC.exe
Token: SeDebugPrivilege	1540	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1540	WMIC.exe
Token: SeRemoteShutdownPrivilege	1540	WMIC.exe
Token: SeUndockPrivilege	1540	WMIC.exe
Token: SeManageVolumePrivilege	1540	WMIC.exe
Token: 33	1540	WMIC.exe
Token: 34	1540	WMIC.exe
Token: 35	1540	WMIC.exe
Token: 36	1540	WMIC.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 4276	3952	2026-04-23_3546bbcc5980f97f549eb93bbd824d19_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe	80
PID 4276 wrote to memory of 3096	4276	Built.exe	81
PID 4276 wrote to memory of 2400	4276	Built.exe	83
PID 4276 wrote to memory of 1244	4276	Built.exe	84
PID 4276 wrote to memory of 2680	4276	Built.exe	87
PID 4276 wrote to memory of 1640	4276	Built.exe	89
PID 4276 wrote to memory of 4836	4276	Built.exe	91
PID 4836 wrote to memory of 1540	4836	cmd.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-04-23_3546bbcc5980f97f549eb93bbd824d19_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_3546bbcc5980f97f549eb93bbd824d19_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\Built.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-04-23_3546bbcc5980f97f549eb93bbd824d19_blankgrabber_coinminer_icedid_luca-stealer_njrat.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:3096
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Process -ErrorAction SilentlyContinue | Select-Object ProcessName, Id | ConvertTo-Json"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2400
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Process -ErrorAction SilentlyContinue | Select-Object ProcessName, Id | ConvertTo-Json"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1244
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Get-Process -ErrorAction SilentlyContinue | Select-Object ProcessName, Id | ConvertTo-Json"
    3⤵
    - Hide Artifacts: Ignore Process Interrupts
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2680
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "ver"
    3⤵
    PID:1640
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "wmic os get Caption /value"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4836
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic os get Caption /value
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 053b95bd7638b472ecc2cebab3709470dba7727f5ce68fcb1cb3f6df7f6e0ef8
MD5 b77b75b586915deb5a9031e971f77f75
SHA1 ecdf9a7173386bf4c15b41c3a5b07d637e6aa031
SHA512 422dafffe35fc02a28a87d276cd541b05469bed940cf2201a5ec11f60587e95d5ceed91df216957abbdcd9ca89d824d08c399055f5a86d6348ea0e4900951baf
TLSH
T15471DD313275B0D489567F07192C19C463BF8356FA94AF4CB698620ED92B44BDF222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 6486f6b89cc0264676c594b2254d487933e77544f078030b85f3a48fdde7bd07
MD5 1cbf7dc51069fcd4277a0393d7225551
SHA1 635cf3ea2f324fb69061a0e18400558abc526478
SHA512 bff70719eb14e43874c5009e7fe5fa0250a546eb72545578153c72f4a81c2e135bc1c55dfa7e145f62eae4d6f1c86516ca6919527a4d14b74b716f5eb077efd8
TLSH
T14D31BE37BB9CC1A8C4AE053910DDA90072F183C784EE8ECB7644810456AF5C9DBA89A4
MD5 SHA1 SHA512 TLSH

Submit Download

AOm8K.zip.enc

Path C:\Users\Admin\AppData\Local\Temp\AOm8K.zip.enc
Size 4KB
SHA256 45ba9bd97c1e15c1168c6e5d9bc776e99b59eaeac4f860856f94420df4ef5b28
MD5 5261efc83b93e8eae00738bf9593c2c6
SHA1 06c288d9c1925224405a064fcc9ccf457d583c4e
SHA512 bb7144c1e2bb3793d0594d7f00f4148773bfdc2f389eea2f4707c37a3f51120b3851bc47038d0028605ef42eec3e782aeb4a3bbcde4f55f342ba5232d9262a7d
SSDEEP 96:pIZ4ILqaBz+kgtgEDV4GIhosB8nrMtUKeim5Lb5RyPQfvXzoFFtQKP:p/aIkVEWrDtfopjWQW
TLSH
T16CA17E40028B571FB4565436674C789403C29FA3A44E24BAA4D47AAD8F37BC3DCAF1CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ghash_clmul.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Hash\_ghash_clmul.pyd
Size 12KB
SHA256 63d9bbdac4e8e2c95b1a41eb7a2b42047b6a0c8d36447165e32167d3c7a57aee
MD5 1dd22e3cfce1c65ffc00c2cfdf273805
SHA1 73a4e6237ad3cb30c7750ddb22e531944bfb6233
SHA512 b32d77ee7177af8b1b027e8f524af9784aa82fc376554a35d216572908e9487a75c70001a41ec68f8c992511dfe0cdf27aa6fa5d1b779468d73405117cc9b12b
SSDEEP 96:UXzBHOTvaNKigvldRMKgUU4sEvJLaVah01YlVlJnOJdS4sPiF1Pzws28dOJoz0Tf:UgTEnb4pJLqah0ux41bwLPS0T7cqg
TLSH
T14642194CFA9656ADE4170176C93B4B4A5AF5B61867E0A3DF036280B91E333D2332DBC5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_strxor.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\Crypto\Util\_strxor.pyd
Size 10KB
SHA256 c77f18f1f7a377bc388de0104abf4868d6f0c2ef7ef2b97b34d875cfc3040aac
MD5 fecc7e50926f0ec3286d9cac0bc3938a
SHA1 e12c70ee106d580a9adb0f81b38734d376266607
SHA512 925cdac89dbb66b8b9f69e9beeda001c4735e16fb1a3e3c0ab94648a7b8915f99469b0bf87e3a0d0ddc39d35a8f66680ae22c96eed22af354aed225b761a25c6
SSDEEP 96:dkEOstOzARCvriZUj01tClcbzMoJqUSzXsPc/7azsncZqkSffcX6gi1:dkEXtOzRr+Uj0TsBz178sncwkgcqgi
TLSH
T13322E888FA568CF6E51582B9C9374E4EB175B710972067CF1374CA691E227CB313A782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ctypes.pyd
Size 121KB
SHA256 b75560db79ba6fb56c393a4886eedd72e60df1e2f7f870fe2e356d08155f367b
MD5 78df76aa0ff8c17edc60376724d206cd
SHA1 9818bd514d3d0fc1749b2d5ef9e4d72d781b51dd
SHA512 6189c1bd56db5b7a9806960bc27742d97d2794acebc32e0a5f634fe0ff863e1775dcf90224504d5e2920a1192a3c1511fb84d41d7a2b69c67d3bdfbab2f968fa
SSDEEP 3072:DJMe7jc823LQHUlYsNZfLIbKV6pJfJIyLPKZ:DWeoL0GNZfLIbCcJfi
TLSH
T188C35B5B27541099EAA780BCC5B35F07C7B1F859171083CF02A4CAA92F637A36E7E716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd
Size 155KB
SHA256 64ba475a28781dca81180a1b8722a81893704f8d8fac0b022c846fdcf95b15b9
MD5 2ae2464bfcc442083424bc05ed9be7d2
SHA1 f64b100b59713e51d90d2e016b1fe573b6507b5d
SHA512 6c3acd3dcae733452ad68477417693af64a7d79558e8ec9f0581289903c2412e2f29195b90e396bfdcd765337a6dea9632e4b8d936ac39b1351cd593cb12ce27
SSDEEP 3072:Bl2grSWcJSEoLSHK/znfU9mNo2s2AaK5VlIyZ1Zxzp:Blh2nJ9a8YO2u7rp
TLSH
T177F34A92A394F4D5F7228C78D6524F17E7F678090320929A02CCC36D2B1FB759A2E767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_sqlite3.pyd
Size 117KB
SHA256 bd3c36976854fa0c885bdd95fb4eb096e29b1967c1f043019b5fa5be1b7bde51
MD5 c8f178bc416050640d547c69115855a1
SHA1 f1ebffe50e4245504848b25b966b0d176c23606f
SHA512 5b85c9e48f4128bc6958b20bfc3954bd5ff3554298b43f06cfd1930b7c4214d1b61f8d8345cd11fe9ecfee802938aa6c74758ffbf459457f9eecb40ac0ae12f3
SSDEEP 3072:9jwBOktknqUDTBi3CLl147ZvV9NdrRvdO5y2Au4qVMJtcMY6HfidIyOQMC:dKOktwqUxD5KJtNqJ
TLSH
T188C34A6B631810AAE8B781BCC4634A16EB75F461437053CF92A0C5891F377C36F7AB66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Google Chrome CredentialsCache.txt

Path C:\Users\Admin\AppData\Local\Temp\WnNr1PGRhl\Credentials\Google Chrome\Google Chrome CredentialsCache.txt
Size 41B
SHA256 25a86fdf15d880fa1e7651d7047526734443432f62a790095bb6fd004822b6c6
MD5 fd236229ae581e12501e66db2e1db6b1
SHA1 4aa507c2275cde7872e839adc5a8000cbe8a6dd4
SHA512 529e7fe17bff7956abc74ce488911fdbba609ca8c0d267be6fa0728d415f6b8fc8f1a0037117c81a96ba5d0de2046f7f9e5a65404b39b9ff717a636583e9250b
MD5 SHA1 SHA512

Submit Download

Google Chrome FormTemplates.txt

Path C:\Users\Admin\AppData\Local\Temp\WnNr1PGRhl\Credentials\Google Chrome\Google Chrome FormTemplates.txt
Size 20B
SHA256 0da6c3fa76327e314fefcca417ad1be2df5d329d17e6a7701410993bcafd8144
MD5 b277c39d8df0a9f8874be3dd4dc1b966
SHA1 f236c1ea64d16ad43df99a32c833bd3b1c954ca3
SHA512 b40c1572729e06cabdb992c5438115ab3269b4ed677919f8fd7b5ad45c4409a8cd03fc14c471404962d895b53877fff4cd2a3cdebfd285f51519d894bc7a8761
MD5 SHA1 SHA512

Submit Download

Google Chrome NavigationLog.txt

Path C:\Users\Admin\AppData\Local\Temp\WnNr1PGRhl\Credentials\Google Chrome\Google Chrome NavigationLog.txt
Size 18B
SHA256 99f8227bebf1ffe2d356cf563d1683c8ad7e308f0414c9d4d34902d92b158c03
MD5 b88ed74f6e580f2986a6d26069a194dd
SHA1 e5e6c6c5112a08d5068bbedde659520b8f69488e
SHA512 7618fcb54dba6607a4cee087d8d851ac36e1c6f2d5a1001af907ebca1242e0e17ef54bde7c03a14a220b4e0b36d2b1f97ff0c0939e7da4b9826493afa28b72eb
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_alxi1bft.ewd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_alxi1bft.ewd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

Built.exe

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\Built.exe
Size 11.0MB
SHA256 b2a5315aea2530ecce2e3ef5d1b0b20986cab8bfbe0ed9cfb1761a27d17670d1
MD5 bb77cb7dda6847dae46b02e6afa69ffc
SHA1 764e30dde4cb87e08e2c21218071bcf5ad371d75
SHA512 88dcf66d31cc666b1f45edcc16e2a27c466be856053b5cbf7f3329934f27ac95416d260733c9ca1b509c087a9c7f4d67518f8dfa2ce76be57716f68aa03a4493
SSDEEP 98304:Ll4Bc/dbkWxLO3jPAt01z4uDSLVYwaxLaIaiFrEF9o31gr7:RlIWxW48MuDSj
TLSH
T114C64A4076849067F991F77DA8265A8AF770A8A2730297D7349DC04E7F47E642EBE0CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_Salsa20.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\Crypto\Cipher\_Salsa20.pyd
Size 13KB
SHA256 9df33c5ee086899c69bd4f3d776b85a493b72e1316c3f8772ac1215d70068a28
MD5 17c99edf022309bc2c54a732fb8fbf26
SHA1 57a8cbcbf0caed90b8ce9adc8f9188561f4a5e2b
SHA512 f8dc12948abc33487f136b92efe755b7234ea8ea65b40dbfabe6bdcf8214c1dcf3509d1ecf5f21741e5300456b03983739c9f400ef8352fcac9f3edf90c37f92
SSDEEP 192:SBeCWznuR5zIzpshfrQ0ZFqdpofnLjcqg542:SBOCMpqVDqUge2
TLSH
T159521792F32701EAE42B9175CD734A4BAABCBA00635167DB1320C1178C62BE1323E796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\Crypto\Cipher\_raw_aes.pyd
Size 34KB
SHA256 520b343e44b5633bbc4fdcecc705a7f2eb6e55d082a1f3e4723ada9d7e5ea97d
MD5 61cb04bf8e8c111ab4b6fed3be0e8fa9
SHA1 af652b67c6437c0ee640d6f2480ccbf70616b1dc
SHA512 5748fe3738fc0b5d38d581672a73d6d86652dce85c8d9a94a23a33ea24b6becba380ab19f7b261afa842ceefc48d2a0f378cf68dba9e9d75006889f0371144db
SSDEEP 384:JqX8MxMEzllvxL/7v/iKBt5ByU0xGitqzSEkxGG7+tpKHb/LZ7fr5aPU4sqIiRBE:Jqs3C75tCKaVS4j990th9VTT
TLSH
T158F2061465A92656DF850E7AEF03CC0BD6B17821B762F23725E9B30C201B3AE2B7B455
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\Crypto\Cipher\_raw_aesni.pyd
Size 15KB
SHA256 3818873f50418cbecde58150e9bffff7372d2c2067fc0b96ffac9482dfddd603
MD5 133b156e060c77af41b38841a32da4b6
SHA1 9f6871cb0b1e5f2c763907773c7a08a47b4a6516
SHA512 f6095d4ab05ad3a3962cc92effa46d17e3e56edd9371708b21193e99f248640b4952eba4262321c975444404b445dd99d2350c599909e6684dd3351c6c75a7c4
SSDEEP 192:DTHkhuSkYucCzCQ0T/jJCMRU0NumrrBkyYUpXIIMQkcqgGTqc:UhNkYjCXOJvNuarPYUtkgI
TLSH
T157622A8EF65644BCF60502B2C463050AE4BA7520136277DF1320D1AE2FA3BC6766F7E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ctr.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\Crypto\Cipher\_raw_ctr.pyd
Size 14KB
SHA256 aeb1f2943a921684bd1edf752a6355e38de46466f56b3003f5b295fc30053732
MD5 3d0fb2250c76b501abf008d8e6180594
SHA1 e6bd8cd9a1473ca9b74d3f029f0c18e7fc710fb8
SHA512 165ba96e64706f9273abcc964fcdd25acc672e03b95e2e38c4edcfbd6f71daf323496abb055cc66d47d1bcf2120a45c6ea55a2ae4b9b5ba50b68e8a2df341f89
SSDEEP 192:9f7EXDMXiKEEEEEm9JdwdNuRxe7CO/vJcf30pdA4kFoxX6zUIlPrx2cqgVVv:9DEXYz9JdwdNuSLvJz/A49qz5ltWgr
TLSH
T191621A06FA545CBDF61242B8C972450D92BFB9046360BBDF0765D2962E23AC4337F6E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_ecb.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\Crypto\Cipher\_raw_ecb.pyd
Size 10KB
SHA256 98f59f221f102db198c0d7425e8c93cdfa91ce5683d4cadd3f541e1dae0f79a2
MD5 b9f8151c65bdaf81bf9407a32e77959b
SHA1 3670e2d9afb0ddb4e98f301381aae49561c25272
SHA512 21c250f873651bc4fd0dc18d9054a31b0e3c0ec1837910d430943121884fc7728fe8b8340494e0625f9dd90c6dc031fbce5c53a913476051419d7dd06772bc32
SSDEEP 96:dkLC5MmvMN3zAhrZMo4hwFD01tbOlYjMIJKUSUsPNfSzVfqZ7EhSGfcX6g53:dkOJUN3zQGWFD0gB3UsWhncqg5
TLSH
T1A922E889FA5648F6EA1682F5C9374E0EA179B720572233CF0374962A1E627CB3139781
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_BLAKE2s.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\Crypto\Hash\_BLAKE2s.pyd
Size 13KB
SHA256 d1ed1ca3c6802954cd8ca6f5e419c54a357b4a04bb802bab876b04b942a4b862
MD5 efb1f498321597f1aaf7fb6a57603c76
SHA1 1c074ba191dade8b05924dbf4933916817fd19be
SHA512 44f0ec8a4044fed41440ede528e2d2b9005477a8e163de4121f8344dba116e179de98a4131f6ff2d211e44a28c541733742e8263f83b8b6bd1479dd7d96fcbcc
SSDEEP 192:yd8+SBjsK5tcGndG4xfSo06lw7KDy8gJcqgwxCLx:88575trWCvcgwxCL
TLSH
T1F9525C85F6A985FEE85B42B98673490996B9F414635073CF0351C5AE1C33BC6327F385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA1.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\Crypto\Hash\_SHA1.pyd
Size 17KB
SHA256 8f80524247c830d9bb590d025e15ec34d7d337a16e5c4422e2da0448d06c88a6
MD5 d350d601e5716a85f4beeba6e11f54d0
SHA1 8e972659a7867859ca9d36f454e8e2c49634b128
SHA512 a34cbfbdd5a429407d441a5bd163307f18f6af2403b44dc9c0c4365a6a5d8e0b6a3a0a24ef2e272e2e916a3a2a58be0ffe9e90408cfb60e6049fb5b9aa56620c
SSDEEP 192:4Zo2R1J+0eDPSgkNZuOdlptvTuh+Kt/sPLKz2V0uj2IjW+Hrcqg9K2:BOJ+0QPSfu6Oh+FLkgx/dg9
TLSH
T10A823C94EAAA54FDE625C434C6534A2F9379B11A4B61E3CF07E042ED0D233EB5838B1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_SHA256.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\Crypto\Hash\_SHA256.pyd
Size 21KB
SHA256 2d57abc0274265d2ab891fba840c05a34831f61ab5c21d0540fc43bd28cc5ae3
MD5 d950a144de4ba6f7834772196b1853b1
SHA1 c949b8ff73436131ea495c37452c2de19b5296b6
SHA512 cf8fed63c95e9f40c2b595e92981e458ae8f587b464e2144c28ab0b2de7c608075140951e496b92ac3c72f4c61d9fcc0b236966fa49e23c8c7ccc5bdb181ebff
SSDEEP 384:JKXqHGcvYHp5RYcARQOj4MSTjqgPmRIHXqBJ93c3MzMR7kLqhgZvRv:JP/YtswvbHXM3c3ZkLqKZZv
TLSH
T1EAA20B19AF3884A4E40E6039B333867B7BF47610D398B7EF8B505B991C263ED563474A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ghash_portable.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\Crypto\Hash\_ghash_portable.pyd
Size 12KB
SHA256 ca4c4e24af0d7f879f9cb73df6e27f83441071dd466c366a4f4b467101e50e21
MD5 ed8ba1c678bcbe969589a0f20bce9b3a
SHA1 b326823cacd6291636db929a8bfedcf6210cd54a
SHA512 13edde6b06bc6540d067d7316da6667165f526dc6253ff5227e98909ddc92218fc71c21d199ee040b213a5148ed6d880531fc254d2e4573ab0553cd918492669
SSDEEP 192:5T7f40jJIUxDDr+f0SUVxZ7JuuA78VUbB5cqgs:dDq6rSyZ7Cd9g
TLSH
T1D2420A8EF65499E9CD1A0175C4334F0AB6FDFA2067916BCB036266692D33EC1333AB15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_scrypt.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\Crypto\Protocol\_scrypt.pyd
Size 12KB
SHA256 00c9b6915dfb9ed91e8d40c78f6b536c5ccdabd2760fcf9501d0522e97e2d600
MD5 d21f9b5765c83bfd97b4b16027ff83f4
SHA1 1965e7c74ad04f1c36e751bc198b1ceebe6dd793
SHA512 f6248fa077cc74a837b1ec6928919068d0b3c111170e7e1e7eb66bae6e6d05b4ab6bad2ff50cca1ec0e349a3be1ba1fca8d947592e8cd768228d574297de81de
SSDEEP 192:h3B6qjvnrrx5yWva2Hbds/P0pxz9l8lcqgO:/6qTVC2akHrMgO
TLSH
T1B342394DFA5049F9F6124279C4334E5AA5BAB60027B17BCF03A4929A1E733C6323D796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 2af984819d9b1f95132520901b355eb85aa24d5efc6fc5ae9e77252ed03b7f4b
MD5 a55ec6259764fab16bd77aab0371d320
SHA1 2c672cd2939ce864b757b142056e5ca980a53e19
SHA512 6989176a3bbb9dec776ffb0193d7480303241563cfe629f0613749504626aef58cc3168e371e9911e395bee0540c5ca56a3dca621a04451e4ee83eaaccb86ca0
SSDEEP 96:dkDFaMNWHzAxbuH6jTD01tzl8bTtIJKUS9psPeFtJzqxqaC4HcX6gWtDs1:dkVNuzaJjTD0KRB/VbanHcqgWC
TLSH
T161221B49FA5588F6D52D81B5C9278D4ED47AB720C73233CF0370996A1E627CB313A691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\_bz2.pyd
Size 82KB
SHA256 ab34b804da5b8e814b2178754d095a4e8aead77eefd3668da188769392cdb5f4
MD5 afaa11704fda2ed686389080b6ffcb11
SHA1 9a9c83546c2e3b3ccf823e944d5fd07d22318a1b
SHA512 de23bb50f1d416cf4716a5d25fe12f4b66e6226bb39e964d0de0fef1724d35b48c681809589c731d3061a97c62b4dc7b9b7dfe2978f196f2d82ccce286be8a2a
SSDEEP 1536:cfz7OThu5JLlHRGxlDAwGzzVXU8dhkb48UlIyCVJ7SyMxD:cfzSFlDlCHdhkmlIyCVJU
TLSH
T107839D63B76551B5F46B82BA99824323E730FE45075093AFB340835B2F22F927D7436A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\_hashlib.pyd
Size 63KB
SHA256 30adfb86513282e59d7e27968e1ff6686e43b8559994a50c17be66d0789f82b3
MD5 534902be1d8a57974efd025aff4f11ef
SHA1 1179c6153dc52f72c29fe1591dc9a889c2e229e9
SHA512 7f0cdcf8576faf30fc8104b9bc9586d85ad50b7803074a7bcaa192eed05b1e2bd988a91873554fb63f204fcad86c667e95755c5ff13c43f96dc334ef3ea37240
SSDEEP 1536:nuY1lTorKn+zF9G0pLOjWNBgdIyOI8f7SyxxUx:nuY+9GIOjiBgdIyOI8fY
TLSH
T159537D06A29544E4D96781B9C9A34E57F9F2F1001720ABDF4368C18E2F237C3A7F6766
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_queue.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\_queue.pyd
Size 31KB
SHA256 2bfd8459ba01c741d676f79ee96802fb2c29cb30f50301d67fde8bbce8e7e7d4
MD5 dbd3c2c0a348a44a96d76100690c606d
SHA1 04e901eac1161255adb16155459ac50f124b30a6
SHA512 99fee97c272bfff4515407d588b2761af7be39a83be070e01128fba71ff75404fbad6352bcdbe5465786ce86a6550f47b177d022ccb53f32f5a482db61bee3b4
SSDEEP 768:y+yFV6rXzmxU9JIyQUM5YiSyvKtp/AMxkEj:y+wEXzWU9JIyQU27Sy4xH
TLSH
T1FFE29F879AA46C96C527C83194E25E39F975B742970083EF2218C25D1F333437BBA76A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\_socket.pyd
Size 77KB
SHA256 8956b11c07d08d289425e7240b8fa37841a27c435617dbbd02bfe3f9405f422b
MD5 11b7936a5bd929cc76ac3f4f137b5236
SHA1 09cb712fa43dc008eb5185481a5080997aff82ab
SHA512 7b050df283a0ad4295a5be47b99d7361f49a3cfd20691e201c5da5349a9eb8f5710ab3a26a66d194567539660ed227411485f4edf2269567a55a6b8ccfd71096
SSDEEP 1536:sRbflgPFXDclujZ9/s+S+pzpGkTFVf7KJIyLw57SyCxz7:sDm1EujZ9/sT+pz0KFVTKJIyLw567
TLSH
T1C0736B1162A010A9E2B3C07AC1675E23FB74F4C117D597CF5264CA5E5F23782EE7AB82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\_ssl.pyd
Size 172KB
SHA256 bca1f490c9f7ba25cbbb4b39785dda8aa651123e22d4e7edc299b218c8157a81
MD5 0e9e6d6839d74ad40bb9f16cc6601b13
SHA1 6671039088793f4ba42f5bd4409c26b1283ceafa
SHA512 cb8742ae5db83487c21ba17d9efaca736df49f8f3c4a72355ede119717b83e0b4c6d94bd1c75a992abaf4ab89502a805f81b2529e85fd6a656600d6e7b0c90f5
SSDEEP 3072:hjIQQj5DC1z/39/2uXU6XjXylB9d43Olh59YL48PMrN/WgAlNiVlIyC7WN:Kj5mRPxbU6XjK4TLiVL
TLSH
T10B047B47B5442DB7E813E4BAC2334912DBB5F055231147CE49D6DA4A0F07B06AEBABB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\libcrypto-3.dll
Size 4.9MB
SHA256 2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
MD5 51e8a5281c2092e45d8c97fbdbf39560
SHA1 c499c810ed83aaadce3b267807e593ec6b121211
SHA512 98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
SSDEEP 98304:S3+FRtLtlVriXpshX179Cahd4tC9P1+1CPwDvt3uFlDCi:ASRtLtvd99Cahd4tC9w1CPwDvt3uFlDz
TLSH
T1DE367A6AA7A81189E4BAC13CC9534617E6F1F81A177097CF14A1567D0F33BDA2B3EB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\libssl-3.dll
Size 771KB
SHA256 41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
MD5 bfc834bb2310ddf01be9ad9cff7c2a41
SHA1 fb1d601b4fcb29ff1b13b0d2ed7119bd0472205c
SHA512 6af473c7c0997f2847ebe7cee8ef67cd682dee41720d4f268964330b449ba71398fda8954524f9a97cc4cdf9893b8bdc7a1cf40e9e45a73f4f35a37f31c6a9c3
SSDEEP 6144:7aO1lo7USZGjweMMHO4+xuVg7gCl2VdhMd1DdwMVn4TERUr3zgKpJJ/wknofFe9A:FkeMKOr97gCAE35gEGzLpwknofFe9XbE
TLSH
T188F43B9DB3B8059DE9F6D13D86534623E3B6F4152370EBDB065186390F23BD52A3A388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python311.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\python311.dll
Size 5.5MB
SHA256 5ecda62f6fd2822355c560412f6d90be46a7f763f0ffeec9854177904632ac2d
MD5 86e0ad6ba8a9052d1729db2c015daf1c
SHA1 48112072903fff2ec5726cca19cc09e42d6384c7
SHA512 5d6e32f9ff90a9a584183dad1583aea2327b4aea32184b0ebbec3df41b0b833e6bb3cd40822dd64d1033125f52255812b17e4fa0add38fcda6bab1724dfaa2eb
SSDEEP 98304:0asy3088wAPo8yN4yl57G+160THIM1uFvvBnTfDyY:hsy3088wAPo8pyl57G81GrOY
TLSH
T1FA467C22726084A5C97B8072DB2F824BD7B27C506F20CB4B5064B79A2F73B535AEF745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\select.pyd
Size 29KB
SHA256 e7fe45baef9cee192c65fcfce1790ccb6f3f9b81e86df82c08f838e86275af02
MD5 0b55f18218f4c8f30105db9f179afb2c
SHA1 f1914831cf0a1af678970824f1c4438cc05f5587
SHA512 428ee25e99f882af5ad0dedf1ccdbeb1b4022ac286af23b209947a910bf02ae18a761f3152990c84397649702d8208fed269aa3e3a3c65770e21ee1eec064cc1
SSDEEP 384:aEeecReGLnUC0HqGn57AvB0NJIyQGdHQIYiSy1pCQUNIeAM+o/8E9VF0NylE3X:SeUeW4HqIG+JIyQGB5YiSyv2AMxkEg3X
TLSH
T178D29F976F546845D823C972A8E74E16E936B6668710C2CF3358C16C1F327C27BB73A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\sqlite3.dll
Size 1.4MB
SHA256 5a8d544b341f50913d4925fb1b6982cc492d9b4a4e96c0583b61de6f141f67c9
MD5 200db183a1b65800f27dab6bd3db0588
SHA1 063d851f0ef323c2dfb8f3a2d4bcc49f5348944a
SHA512 5d6745690faf71ccacab08f13982c944d4193dd05a44aca8e9e235090d2b9f41daf9dc2052ca584ab79968ca188c819b121b5fe6bbcf93dfe47e79208046739a
SSDEEP 24576:HTqtyGkxOc+wv05tP5kf82Hr/74YPF5o/P/gnAracr7/24UcypY7w0vpZUFn++R:2k0jwv4tP5kf8ar/74EF2/An4acrVUcu
TLSH
T125658C4BF2B800ADC1A7D1BAC61B5707EBB2B405177097DB5594CA692F13FE217BA320
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\unicodedata.pyd
Size 1.1MB
SHA256 71d27537eb1e6de76fd145da4fdcbc379dc54de7854c99b2e61aae00109c13d0
MD5 d4323ac0baab59aed34c761f056d50a9
SHA1 843687689d21ede9818c6fc5f3772bcf914f8a6e
SHA512 e31d071ce920b3e83c89505dfa22b2d0f09d43c408fcadbc910f021481c4a53c47919fce0215ae61f00956dcb7171449eabda8eef63a6fdd47aa13c7158577be
SSDEEP 12288:3YPYbfjwR6nbkonRiPDjRrO5184EPYPx++ZiLKGZ5KXyVH4eDqLo:3aYbMR0IDJcjEwPgPOG6Xyd46qLo
TLSH
T132355BC9BB828D66D87B31B944D2212F1361C273475B233BB65513285C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\AppData\Local\Temp\onefile_3952_134214502882432188\vcruntime140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1244-116-0x00000169B7590000-0x00000169B759C000-memory.dmp

Download

memory/1244-117-0x00000169B9270000-0x00000169B9282000-memory.dmp

Download

memory/1244-109-0x00000169D1AF0000-0x00000169D1CB2000-memory.dmp

Download

memory/1244-101-0x00000169D1310000-0x00000169D1332000-memory.dmp

Download

memory/2400-114-0x0000025B46DE0000-0x0000025B46DEC000-memory.dmp

Download

memory/2400-115-0x0000025B48B40000-0x0000025B48B52000-memory.dmp

Download

memory/2400-110-0x0000025B61920000-0x0000025B61E48000-memory.dmp

Download

memory/2680-142-0x0000015B8EC30000-0x0000015B8EC3C000-memory.dmp

Download

memory/2680-143-0x0000015B90500000-0x0000015B90512000-memory.dmp

Download