Overview

overview

10

Static

static

10

2026-08-24...ar.exe

windows10-2004-x64

10

2026-08-24...ar.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    25/08/2026, 12:38

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-24_5b932cedac0693093c975bdedf1323ad_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
  • Size 57.4MB
  • Sample260825-pt98casdnc
  • SHA256 b346c66cd5595e03d0e9616a7720a55d9baede54517da3c6b8ad429569628158
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
credential_accessdefense_evasiondiscoveryexecutionluna_stealerpersistenceprivilege_escalationspywarestealerupx

Malware Config

Signatures

  • Family: LunaStealer

    LunaStealer is an infostealer written in Python and packaged with Pyinstaller.

    stealerluna_stealer
  • LunaStealer is a stealer written in Python and packaged with Pyinstaller 2 IoCs
  • Creates a file in the Startup directory 1 TTPs 3 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Loads dropped DLL 60 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service 1 TTPs 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  • Hide Artifacts: Hidden Files and Directories 1 TTPs 1 IoCs
    defense_evasion
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 10 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 1 IoCs

    Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

    discovery
  • Detects videocard installed 1 TTPs 2 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies registry class 1 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-24_5b932cedac0693093c975bdedf1323ad_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-24_5b932cedac0693093c975bdedf1323ad_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:552
    • C:\Users\Admin\AppData\Local\Temp\2026-08-24_5b932cedac0693093c975bdedf1323ad_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-24_5b932cedac0693093c975bdedf1323ad_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe"
      2⤵
      • Creates a file in the Startup directory
      • Loads dropped DLL
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1428
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
        • Executes a command shell one-liner
        PID:4080
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:4908
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic csproduct get uuid
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2824
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2400
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic path win32_VideoController get name
          4⤵
          • Detects videocard installed
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2376
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\‍    .scr"
        3⤵
        • Hide Artifacts: Hidden Files and Directories
        • Suspicious use of WriteProcessMemory
        PID:2016
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\‍    .scr"
          4⤵
          • Creates a file in the Startup directory
          • Views/modifies file attributes
          PID:1820
      • C:\Windows\SYSTEM32\netsh.exe
        netsh wlan show profiles
        3⤵
        • Event Triggered Execution: Netsh Helper DLL
        • System Network Configuration Discovery: Wi-Fi Discovery
        PID:2636
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic os get Caption"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2356
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic os get Caption
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:2616
      • C:\Windows\System32\Wbem\wmic.exe
        wmic cpu get Name
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2136
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5900
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic path win32_VideoController get name
          4⤵
          • Detects videocard installed
          • Suspicious behavior: EnumeratesProcesses
          PID:4184
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5480
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic computersystem get totalphysicalmemory
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4060
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5880
        • C:\Windows\System32\wbem\WMIC.exe
          C:\\Windows\\System32\\wbem\\WMIC.exe csproduct get uuid
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:3740
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "wmic path softwarelicensingservice get OA3xOriginalProductKey"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:5672
        • C:\Windows\System32\Wbem\WMIC.exe
          wmic path softwarelicensingservice get OA3xOriginalProductKey
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4856
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:1356
        • C:\Windows\System32\Wbem\WMIC.exe
          WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4624
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ping localhost -n 3 > NUL && del /A H /F "C:\Users\Admin\AppData\Local\Temp\2026-08-24_5b932cedac0693093c975bdedf1323ad_cobalt-strike_glassworm_icedid_luca-stealer_njrat_satacom_vidar.exe""
        3⤵
        • Executes a command shell one-liner
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:4292
        • C:\Windows\system32\PING.EXE
          ping localhost -n 3
          4⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4980

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Execution

        Command and Scripting Interpreter

        1
        T1059

        Windows Command Shell

        1
        T1059.003

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Event Triggered Execution

        1
        T1546

        Netsh Helper DLL

        1
        T1546.007

        Defense Evasion

        Hide Artifacts

        2
        T1564

        Hidden Files and Directories

        2
        T1564.001

        Credential Access

        Credentials from Password Stores

        1
        T1555

        Credentials from Web Browsers

        1
        T1555.003

        Unsecured Credentials

        3
        T1552

        Credentials In Files

        3
        T1552.001

        Discovery

        Browser Information Discovery

        1
        T1217

        Remote System Discovery

        1
        T1018

        System Information Discovery

        1
        T1082

        System Network Configuration Discovery

        3
        T1016

        Internet Connection Discovery

        2
        T1016.001

        Wi-Fi Discovery

        1
        T1016.002

        Lateral Movement

        Collection

        Data from Local System

        2
        T1005

        Command and Control

        Web Service

        1
        T1102

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        VCRUNTIME140.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\VCRUNTIME140.dll
        • Size 96KB
        • SHA256 d66c3b47091ceb3f8d3cc165a43d285ae919211a0c0fcb74491ee574d8d464f8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _bz2.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\_bz2.pyd
        • Size 46KB
        • SHA256 47af0730824f96865b5e20f8bba34b0d5f3a330087411adba71269312bf7ccec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ctypes.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\_ctypes.pyd
        • Size 57KB
        • SHA256 490a11d03dd3aeb05a410eb0d285e3da788e73b643ea9914fffd5a2c102dc1df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _lzma.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\_lzma.pyd
        • Size 84KB
        • SHA256 0ebdf15c1c6d59e49716dfb4601f0abe6383449c70db1a349c6ad486742144a8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-console-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-console-l1-1-0.dll
        • Size 21KB
        • SHA256 b1b3fd40ab437a43c8db4994ccffc7f88000cc8bb6e34a2bcbff8e2464930c59
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-datetime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-datetime-l1-1-0.dll
        • Size 21KB
        • SHA256 0d0f80cbf476af5b1c9fd3775e086ed0dfdb510cd0cc208ec1ccb04572396e3e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-debug-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-debug-l1-1-0.dll
        • Size 21KB
        • SHA256 7cf0944901f7f7e0d0b9ad62753fc2fe380461b1cce8cdc7e9c9867c980e3b0e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-errorhandling-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-errorhandling-l1-1-0.dll
        • Size 21KB
        • SHA256 ab25a1fe836fc68bcb199f1fe565c27d26af0c390a38da158e0d8815efe1103e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-file-l1-1-0.dll
        • Size 25KB
        • SHA256 3d2c55902385381869db850b526261ddeb4628b83e690a32b67d2e0936b2c6ed
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-file-l1-2-0.dll
        • Size 21KB
        • SHA256 ef13dce8f71173315dfc64ab839b033ab19a968ee15230e9d4d2c9d558efeee2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-file-l2-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-file-l2-1-0.dll
        • Size 18KB
        • SHA256 1ea267a2e6284f17dd548c6f2285e19f7edb15d6e737a55391140ce5cb95225e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-handle-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-handle-l1-1-0.dll
        • Size 21KB
        • SHA256 1a489e0606484bd71a0d9cb37a1dc6ca8437777b3d67bfc8c0075d0cc59e6238
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-heap-l1-1-0.dll
        • Size 21KB
        • SHA256 332ba469ae84aa72ec8cce2b33781db1ab81a42ece5863f7a3cb5a990059594f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-interlocked-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-interlocked-l1-1-0.dll
        • Size 21KB
        • SHA256 8751d30df554af08ef42d2faa0a71abcf8c7d17ce9e9ff2ea68a4662603ec500
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-libraryloader-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-libraryloader-l1-1-0.dll
        • Size 21KB
        • SHA256 9c8a08a7d40b6f697a21054770f1afa9ffb197f90ef1eee77c67751df28b7142
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-localization-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-localization-l1-2-0.dll
        • Size 21KB
        • SHA256 4e975f618df01a492ae433dff0dd713774d47568e44c377ceef9e5b34aad1210
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-memory-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-memory-l1-1-0.dll
        • Size 21KB
        • SHA256 3f81a149ba3862776af307d5c7feef978f258196f0a1bf909da2d3f440ff954d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-namedpipe-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-namedpipe-l1-1-0.dll
        • Size 21KB
        • SHA256 5476db3a4fecf532f96d48f9802c966fdef98ec8d89978a79540cb4db352c15f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processenvironment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-processenvironment-l1-1-0.dll
        • Size 21KB
        • SHA256 0b6b598ec28a9e3d646f2bb37e1a57a3dda069a55fba86333727719585b1886e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processthreads-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-processthreads-l1-1-0.dll
        • Size 21KB
        • SHA256 be8d78978d81555554786e08ce474f6af1de96fcb7fa2f1ce4052bc80c6b2125
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-processthreads-l1-1-1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-processthreads-l1-1-1.dll
        • Size 21KB
        • SHA256 57cc66bf0909c430364d35d92b64eb8b6a15dc201765403725fe323f39e8ac54
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-profile-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-profile-l1-1-0.dll
        • Size 21KB
        • SHA256 e1c5d8984a674925fa4afbfe58228be5323fe5123abcd17ec4160295875a625f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-rtlsupport-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-rtlsupport-l1-1-0.dll
        • Size 21KB
        • SHA256 3c29730df2b28985a30d9c82092a1faa0ceb7ffc1bd857d1ef6324cf5524802f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-string-l1-1-0.dll
        • Size 21KB
        • SHA256 27e9d3e7c8756e4512932d674a738bf4c2969f834d65b2b79c342a22f662f328
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-synch-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-synch-l1-1-0.dll
        • Size 21KB
        • SHA256 61c0ebe60ce6ebabcb927ddff837a9bf17e14cd4b4c762ab709e630576ec7232
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-synch-l1-2-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-synch-l1-2-0.dll
        • Size 21KB
        • SHA256 433bd8ddc4f79aee65ca94a54286d75e7d92b019853a883e51c2b938d2469baa
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-sysinfo-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-sysinfo-l1-1-0.dll
        • Size 21KB
        • SHA256 0dc92e8830bc84337dcae19ef03a84ef5279cf7d4fdc2442c1bc25320369f9df
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-timezone-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-timezone-l1-1-0.dll
        • Size 21KB
        • SHA256 f60e1751a6ac41f08e46480bf8e6521b41e2e427803996b32bdc5e78e9560781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-core-util-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-core-util-l1-1-0.dll
        • Size 21KB
        • SHA256 2e1f090aba941b9d2d503e4cd735c958df7bb68f1e9bdc3f47692e1571aaac2f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-conio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-crt-conio-l1-1-0.dll
        • Size 21KB
        • SHA256 93619259328a264287aee7c5b88f7f0ee32425d7323ce5dc5a2ef4fe3bed90d5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-convert-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-crt-convert-l1-1-0.dll
        • Size 25KB
        • SHA256 b987ab40cdd950ebe7a9a9176b80b8fffc005ccd370bb1cbbcad078c1a506bdc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-environment-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-crt-environment-l1-1-0.dll
        • Size 21KB
        • SHA256 2f6bd6c235e044755d5707bd560a6afc0ba712437530f76d11079d67c0cf3200
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-filesystem-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-crt-filesystem-l1-1-0.dll
        • Size 21KB
        • SHA256 94a86e28e829276974e01f8a15787fde6ed699c8b9dc26f16a51765c86c3eade
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-heap-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-crt-heap-l1-1-0.dll
        • Size 21KB
        • SHA256 8dd9218998b4c4c9e8d8b0f8b9611d49419b3c80daa2f437cbf15bcfd4c0b3b8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-locale-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-crt-locale-l1-1-0.dll
        • Size 21KB
        • SHA256 551a34c400522957063a2d71fa5aba1cd78cc4f61f0ace1cd42cc72118c500c0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-math-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-crt-math-l1-1-0.dll
        • Size 29KB
        • SHA256 1c4a70a73096b64b536be8132ed402bcfb182c01b8a451bff452efe36ddf76e7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-multibyte-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-crt-multibyte-l1-1-0.dll
        • Size 29KB
        • SHA256 3a4b66e65a5ee311afc37157a8101aba6017ff7a4355b4dd6e6c71d5b7223560
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-private-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-crt-private-l1-1-0.dll
        • Size 73KB
        • SHA256 8b19bcb4918b346a8ba5e19d91823e5842314e928dbb86de8758d0dbb2b94bb4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-process-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-crt-process-l1-1-0.dll
        • Size 21KB
        • SHA256 bd943767f3e0568e19fb52522217c22b6627b66a3b71cd38dd6653b50662f39d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-runtime-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-crt-runtime-l1-1-0.dll
        • Size 25KB
        • SHA256 962d725d089f140482ee9a8ff57f440a513387dd03fdc06b3a28562c8090c0bc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-stdio-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-crt-stdio-l1-1-0.dll
        • Size 25KB
        • SHA256 273817a137ee049cbd8e51dc0bb1c7987df7e3bf4968940ee35376f87ef2ef8d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-string-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-crt-string-l1-1-0.dll
        • Size 25KB
        • SHA256 415025dce5a086dbffc4cf322e8ead55cb45f6d946801f6f5193df044db2f004
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-time-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-crt-time-l1-1-0.dll
        • Size 21KB
        • SHA256 82fba9bc21f77309a649edc8e6fc1900f37e3ffcb45cd61e65e23840c505b945
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        api-ms-win-crt-utility-l1-1-0.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\api-ms-win-crt-utility-l1-1-0.dll
        • Size 21KB
        • SHA256 2e554d9bf872a64d2cd0f0eb9d5a06dea78548bc0c7a6f76e0a0c8c069f3c0a9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        base_library.zip
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\base_library.zip
        • Size 1.4MB
        • SHA256 130e506ead01b91b60d6d56072c468aeb5457dd0f2ecd6ce17dfcbb7d51a1f8c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libcrypto-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\libcrypto-1_1.dll
        • Size 1.1MB
        • SHA256 6242d2e13aef871c4b8cfd75fc0f8530e8dccfeaba8f1b66280e9345f52b833b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libffi-8.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\libffi-8.dll
        • Size 24KB
        • SHA256 18c097ef19f3e502a025c1d63cfec73a4fa30c5482286f4000d40d4784a0070a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libssl-1_1.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\libssl-1_1.dll
        • Size 203KB
        • SHA256 84e4c37fb28b6cf79e2386163fe6bb094a50c1e8825a4bcdb4cb216f4236d831
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        luna.aes
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\luna.aes
        • Size 104KB
        • SHA256 e388f17b7059d903100d4becbf4c3bcb8e6fa65857ea9b44f007f8805c95d6af
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        pyexpat.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\pyexpat.pyd
        • Size 86KB
        • SHA256 297ec9e654500400ba5731101b65d29c14d0305ae9f6c05b9763f57ab150b07d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python3.DLL
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\python3.DLL
        • Size 64KB
        • SHA256 4055d1b9e553b78c244143ab6b48151604003b39a9bf54879dee9175455c1281
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        python311.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\python311.dll
        • Size 1.6MB
        • SHA256 a67df621a383f4ce5a408e0debe3ebc49ffc766d6a1d6d9a7942120b8ec054dc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        select.pyd
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\select.pyd
        • Size 24KB
        • SHA256 818120c08358b6b4d1234b7456c7b5c777af8473e26314a6a6c0f37237d53208
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        sqlite3.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\sqlite3.dll
        • Size 608KB
        • SHA256 a61016520a3f228285e32e40d878fe449450136c55aa9d4d7b54006a8dc7f339
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ucrtbase.dll
        • Path C:\Users\Admin\AppData\Local\Temp\_MEI5522\ucrtbase.dll
        • Size 992KB
        • SHA256 8a91052ef261b5fbf3223ae9ce789af73dfe1e9b0ba5bdbc4d564870a24f2bae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        cc's.txt
        • Path C:\Users\Admin\AppData\Local\Temp\zpXiQSOM8g\Browser\cc's.txt
        • Size 91B
        • SHA256 c4c83da3a904a4e7114f9bd46790db502cdd04800e684accb991cd1a08ee151c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        history.txt
        • Path C:\Users\Admin\AppData\Local\Temp\zpXiQSOM8g\Browser\history.txt
        • Size 83B
        • SHA256 7fb621511f8419114230df9e4217ca7063e1480b01122a77d707cc8216ae0bff
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        BlockUninstall.docx
        • Path C:\Users\Admin\AppData\Local\Temp\zpXiQSOM8g\Common Files\BlockUninstall.docx
        • Size 14KB
        • SHA256 8cb380b52509b7c6d3c688a90238dc9ffdd59af7b31c01395fdd69c023a18f53
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DismountAdd.odt
        • Path C:\Users\Admin\AppData\Local\Temp\zpXiQSOM8g\Common Files\DismountAdd.odt
        • Size 699KB
        • SHA256 44a015d09371f3b79755d5fb7abd53720f1c27f3f7f590149f387442e51ac1a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ExitMount.docx
        • Path C:\Users\Admin\AppData\Local\Temp\zpXiQSOM8g\Common Files\ExitMount.docx
        • Size 12KB
        • SHA256 d1a122671a7fbedd35e6b0fcc4bdb8d2d48d5f9d3810dfd39b837c022d07c8e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SuspendReceive.odt
        • Path C:\Users\Admin\AppData\Local\Temp\zpXiQSOM8g\Common Files\SuspendReceive.odt
        • Size 392KB
        • SHA256 3d35ceaa7d65f3056d816f7bad875fcd19b2f784157a9766c5fd7bd44a6d3575
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        UseUnregister.xls
        • Path C:\Users\Admin\AppData\Local\Temp\zpXiQSOM8g\Common Files\UseUnregister.xls
        • Size 319KB
        • SHA256 fbf9969549d8ee4184368747a716c7c304d425b600206685dce2c08aa98fb3f6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1428-883-0x00007FFC1FA80000-0x00007FFC1FA8C000-memory.dmp
        Download

        memory/1428-800-0x00007FFC1DFD0000-0x00007FFC1DFFD000-memory.dmp
        Download

        memory/1428-849-0x00007FFC26200000-0x00007FFC2620D000-memory.dmp
        Download

        memory/1428-854-0x00007FFC1E000000-0x00007FFC1E024000-memory.dmp
        Download

        memory/1428-798-0x00007FFC200C0000-0x00007FFC200D9000-memory.dmp
        Download

        memory/1428-792-0x00007FFC1E000000-0x00007FFC1E024000-memory.dmp
        Download

        memory/1428-855-0x00007FFC1B760000-0x00007FFC1B78B000-memory.dmp
        Download

        memory/1428-856-0x00007FFC17140000-0x00007FFC1716E000-memory.dmp
        Download

        memory/1428-857-0x00007FFC17080000-0x00007FFC17138000-memory.dmp
        Download

        memory/1428-858-0x00007FFC14910000-0x00007FFC14C85000-memory.dmp
        Download

        memory/1428-859-0x0000016372700000-0x0000016372A75000-memory.dmp
        Download

        memory/1428-861-0x00007FFC1D8A0000-0x00007FFC1D8B5000-memory.dmp
        Download

        memory/1428-860-0x00007FFC1DF70000-0x00007FFC1DF89000-memory.dmp
        Download

        memory/1428-862-0x00007FFC1B740000-0x00007FFC1B752000-memory.dmp
        Download

        memory/1428-863-0x00007FFC16FF0000-0x00007FFC17077000-memory.dmp
        Download

        memory/1428-865-0x00007FFC1B2B0000-0x00007FFC1B2C4000-memory.dmp
        Download

        memory/1428-864-0x00007FFC1D8C0000-0x00007FFC1D8EE000-memory.dmp
        Download

        memory/1428-867-0x00007FFC24780000-0x00007FFC2478B000-memory.dmp
        Download

        memory/1428-866-0x00007FFC17170000-0x00007FFC1722C000-memory.dmp
        Download

        memory/1428-868-0x00007FFC16AB0000-0x00007FFC16AD7000-memory.dmp
        Download

        memory/1428-869-0x00007FFC17140000-0x00007FFC1716E000-memory.dmp
        Download

        memory/1428-870-0x00007FFC15660000-0x00007FFC1577C000-memory.dmp
        Download

        memory/1428-871-0x00007FFC17080000-0x00007FFC17138000-memory.dmp
        Download

        memory/1428-872-0x00007FFC244A0000-0x00007FFC244AA000-memory.dmp
        Download

        memory/1428-876-0x00007FFC16A20000-0x00007FFC16A43000-memory.dmp
        Download

        memory/1428-875-0x00007FFC1B200000-0x00007FFC1B218000-memory.dmp
        Download

        memory/1428-874-0x0000016372700000-0x0000016372A75000-memory.dmp
        Download

        memory/1428-873-0x00007FFC14910000-0x00007FFC14C85000-memory.dmp
        Download

        memory/1428-877-0x00007FFC1D8A0000-0x00007FFC1D8B5000-memory.dmp
        Download

        memory/1428-879-0x00007FFC169E0000-0x00007FFC16A17000-memory.dmp
        Download

        memory/1428-881-0x00007FFC24270000-0x00007FFC2427B000-memory.dmp
        Download

        memory/1428-882-0x00007FFC22390000-0x00007FFC2239B000-memory.dmp
        Download

        memory/1428-852-0x00007FFC12690000-0x00007FFC12C78000-memory.dmp
        Download

        memory/1428-885-0x00007FFC1DF60000-0x00007FFC1DF6B000-memory.dmp
        Download

        memory/1428-887-0x00007FFC1B940000-0x00007FFC1B94B000-memory.dmp
        Download

        memory/1428-889-0x00007FFC1B280000-0x00007FFC1B28C000-memory.dmp
        Download

        memory/1428-893-0x00007FFC19560000-0x00007FFC1956E000-memory.dmp
        Download

        memory/1428-896-0x00007FFC19050000-0x00007FFC1905B000-memory.dmp
        Download

        memory/1428-898-0x00007FFC169D0000-0x00007FFC169DC000-memory.dmp
        Download

        memory/1428-901-0x00007FFC15630000-0x00007FFC15642000-memory.dmp
        Download

        memory/1428-903-0x00007FFC155F0000-0x00007FFC15619000-memory.dmp
        Download

        memory/1428-902-0x00007FFC15620000-0x00007FFC1562C000-memory.dmp
        Download

        memory/1428-906-0x00007FFC155E0000-0x00007FFC155EB000-memory.dmp
        Download

        memory/1428-907-0x00007FFC14890000-0x00007FFC148AC000-memory.dmp
        Download

        memory/1428-900-0x00007FFC15650000-0x00007FFC1565D000-memory.dmp
        Download

        memory/1428-908-0x00007FFC120E0000-0x00007FFC12507000-memory.dmp
        Download

        memory/1428-899-0x00007FFC169C0000-0x00007FFC169CB000-memory.dmp
        Download

        memory/1428-897-0x00007FFC16FE0000-0x00007FFC16FEB000-memory.dmp
        Download

        memory/1428-895-0x00007FFC19060000-0x00007FFC1906C000-memory.dmp
        Download

        memory/1428-894-0x00007FFC169E0000-0x00007FFC16A17000-memory.dmp
        Download

        memory/1428-892-0x00007FFC19570000-0x00007FFC1957D000-memory.dmp
        Download

        memory/1428-891-0x00007FFC12510000-0x00007FFC12683000-memory.dmp
        Download

        memory/1428-890-0x00007FFC16A20000-0x00007FFC16A43000-memory.dmp
        Download

        memory/1428-888-0x00007FFC1B200000-0x00007FFC1B218000-memory.dmp
        Download

        memory/1428-886-0x00007FFC1D340000-0x00007FFC1D34C000-memory.dmp
        Download

        memory/1428-884-0x00007FFC16AB0000-0x00007FFC16AD7000-memory.dmp
        Download

        memory/1428-880-0x00007FFC16FF0000-0x00007FFC17077000-memory.dmp
        Download

        memory/1428-878-0x00007FFC12510000-0x00007FFC12683000-memory.dmp
        Download

        memory/1428-910-0x00007FFC147D0000-0x00007FFC147F2000-memory.dmp
        Download

        memory/1428-909-0x00007FFC10D20000-0x00007FFC120D1000-memory.dmp
        Download

        memory/1428-941-0x00007FFC155F0000-0x00007FFC15619000-memory.dmp
        Download

        memory/1428-853-0x00007FFC17170000-0x00007FFC1722C000-memory.dmp
        Download

        memory/1428-850-0x00007FFC25B50000-0x00007FFC25B5D000-memory.dmp
        Download

        memory/1428-851-0x00007FFC1D8C0000-0x00007FFC1D8EE000-memory.dmp
        Download

        memory/1428-848-0x00007FFC1DF70000-0x00007FFC1DF89000-memory.dmp
        Download

        memory/1428-847-0x00007FFC1DF90000-0x00007FFC1DFC5000-memory.dmp
        Download

        memory/1428-794-0x00007FFC26780000-0x00007FFC2678F000-memory.dmp
        Download

        memory/1428-784-0x00007FFC12690000-0x00007FFC12C78000-memory.dmp
        Download

        memory/1428-988-0x00007FFC17080000-0x00007FFC17138000-memory.dmp
        Download

        memory/1428-987-0x00007FFC17140000-0x00007FFC1716E000-memory.dmp
        Download

        memory/1428-985-0x00007FFC17170000-0x00007FFC1722C000-memory.dmp
        Download

        memory/1428-975-0x00007FFC12690000-0x00007FFC12C78000-memory.dmp
        Download

        memory/1428-984-0x00007FFC1D8C0000-0x00007FFC1D8EE000-memory.dmp
        Download

        memory/1428-983-0x00007FFC25B50000-0x00007FFC25B5D000-memory.dmp
        Download

        memory/1428-981-0x00007FFC1DF70000-0x00007FFC1DF89000-memory.dmp
        Download

        memory/1428-976-0x00007FFC1E000000-0x00007FFC1E024000-memory.dmp
        Download

        memory/1428-999-0x00007FFC120E0000-0x00007FFC12507000-memory.dmp
        Download

        memory/1428-1000-0x00007FFC10D20000-0x00007FFC120D1000-memory.dmp
        Download

        memory/1428-1008-0x00007FFC26780000-0x00007FFC2678F000-memory.dmp
        Download

        memory/1428-1006-0x00007FFC12690000-0x00007FFC12C78000-memory.dmp
        Download

        memory/1428-1016-0x00007FFC17170000-0x00007FFC1722C000-memory.dmp
        Download

        memory/1428-1019-0x00007FFC17080000-0x00007FFC17138000-memory.dmp
        Download

        memory/1428-1027-0x00007FFC15660000-0x00007FFC1577C000-memory.dmp
        Download

        memory/1428-1030-0x00007FFC2CC50000-0x00007FFC2CC5F000-memory.dmp
        Download

        memory/1428-1020-0x00007FFC14910000-0x00007FFC14C85000-memory.dmp
        Download

        memory/1428-1031-0x0000016372700000-0x0000016372A75000-memory.dmp
        Download

        memory/1428-1054-0x00007FFC14890000-0x00007FFC148AC000-memory.dmp
        Download

        memory/1428-1056-0x00007FFC147D0000-0x00007FFC147F2000-memory.dmp
        Download

        memory/1428-1055-0x00007FFC120E0000-0x00007FFC12507000-memory.dmp
        Download

        memory/1428-1053-0x00007FFC155E0000-0x00007FFC155EB000-memory.dmp
        Download

        memory/1428-1052-0x00007FFC155F0000-0x00007FFC15619000-memory.dmp
        Download

        memory/1428-1051-0x00007FFC15620000-0x00007FFC1562C000-memory.dmp
        Download

        memory/1428-1050-0x00007FFC15630000-0x00007FFC15642000-memory.dmp
        Download

        memory/1428-1049-0x00007FFC15650000-0x00007FFC1565D000-memory.dmp
        Download

        memory/1428-1048-0x00007FFC169C0000-0x00007FFC169CB000-memory.dmp
        Download

        memory/1428-1047-0x00007FFC169D0000-0x00007FFC169DC000-memory.dmp
        Download

        memory/1428-1046-0x00007FFC16FE0000-0x00007FFC16FEB000-memory.dmp
        Download

        memory/1428-1045-0x00007FFC19050000-0x00007FFC1905B000-memory.dmp
        Download

        memory/1428-1044-0x00007FFC19060000-0x00007FFC1906C000-memory.dmp
        Download

        memory/1428-1043-0x00007FFC19560000-0x00007FFC1956E000-memory.dmp
        Download

        memory/1428-1042-0x00007FFC19570000-0x00007FFC1957D000-memory.dmp
        Download

        memory/1428-1041-0x00007FFC1B280000-0x00007FFC1B28C000-memory.dmp
        Download

        memory/1428-1040-0x00007FFC1B940000-0x00007FFC1B94B000-memory.dmp
        Download

        memory/1428-1039-0x00007FFC1D340000-0x00007FFC1D34C000-memory.dmp
        Download

        memory/1428-1038-0x00007FFC1DF60000-0x00007FFC1DF6B000-memory.dmp
        Download

        memory/1428-1037-0x00007FFC1FA80000-0x00007FFC1FA8C000-memory.dmp
        Download

        memory/1428-1036-0x00007FFC22390000-0x00007FFC2239B000-memory.dmp
        Download

        memory/1428-1035-0x00007FFC24270000-0x00007FFC2427B000-memory.dmp
        Download

        memory/1428-1034-0x00007FFC12510000-0x00007FFC12683000-memory.dmp
        Download

        memory/1428-1033-0x00007FFC169E0000-0x00007FFC16A17000-memory.dmp
        Download

        memory/1428-1032-0x00007FFC16A20000-0x00007FFC16A43000-memory.dmp
        Download

        memory/1428-1029-0x00007FFC1B200000-0x00007FFC1B218000-memory.dmp
        Download

        memory/1428-1028-0x00007FFC244A0000-0x00007FFC244AA000-memory.dmp
        Download

        memory/1428-1026-0x00007FFC16AB0000-0x00007FFC16AD7000-memory.dmp
        Download

        memory/1428-1025-0x00007FFC24780000-0x00007FFC2478B000-memory.dmp
        Download

        memory/1428-1024-0x00007FFC1B2B0000-0x00007FFC1B2C4000-memory.dmp
        Download

        memory/1428-1023-0x00007FFC16FF0000-0x00007FFC17077000-memory.dmp
        Download

        memory/1428-1022-0x00007FFC1B740000-0x00007FFC1B752000-memory.dmp
        Download

        memory/1428-1021-0x00007FFC1D8A0000-0x00007FFC1D8B5000-memory.dmp
        Download

        memory/1428-1018-0x00007FFC17140000-0x00007FFC1716E000-memory.dmp
        Download

        memory/1428-1017-0x00007FFC1B760000-0x00007FFC1B78B000-memory.dmp
        Download

        memory/1428-1015-0x00007FFC1D8C0000-0x00007FFC1D8EE000-memory.dmp
        Download

        memory/1428-1014-0x00007FFC25B50000-0x00007FFC25B5D000-memory.dmp
        Download

        memory/1428-1013-0x00007FFC26200000-0x00007FFC2620D000-memory.dmp
        Download

        memory/1428-1012-0x00007FFC1DF70000-0x00007FFC1DF89000-memory.dmp
        Download

        memory/1428-1011-0x00007FFC1DF90000-0x00007FFC1DFC5000-memory.dmp
        Download

        memory/1428-1010-0x00007FFC1DFD0000-0x00007FFC1DFFD000-memory.dmp
        Download

        memory/1428-1009-0x00007FFC200C0000-0x00007FFC200D9000-memory.dmp
        Download

        memory/1428-1007-0x00007FFC1E000000-0x00007FFC1E024000-memory.dmp
        Download