Overview

overview

8

Static

static

1

install-qw...ne.ps1

windows10-2004-x64

3

install-qw...ne.ps1

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    127s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/07/2026, 18:24

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    install-qwen-standalone.ps1
  • Size 13KB
  • Sample260706-w2awsafv9m
  • SHA256 901f2974d849a7366dcdbfe0fb23a6e85a97a563570e1e7aa5415a5f634da1c8
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
adwarediscoveryexecutionpersistencespyware

Malware Config

Signatures

  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Using powershell.exe command.

    execution
  • System Time Discovery 1 TTPs 3 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs

Processes

  • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\install-qwen-standalone.ps1
    1⤵
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4780
    • C:\Windows\system32\curl.exe
      "C:\Windows\system32\curl.exe" --connect-timeout 15 --max-time 300 --retry 2 -sSfLo C:\Users\Admin\AppData\Local\Temp\qwen-installer-hehi2j4r.th1.bat https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/install-qwen-standalone.bat
      2⤵
        PID:4388
      • C:\Windows\system32\curl.exe
        "C:\Windows\system32\curl.exe" --connect-timeout 15 --max-time 300 --retry 2 -sSfLo C:\Users\Admin\AppData\Local\Temp\qwen-installation-SHA256SUMS-hehi2j4r.th1 https://qwen-code-assets.oss-cn-hangzhou.aliyuncs.com/installation/SHA256SUMS
        2⤵
          PID:2952
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\qwen-installer-hehi2j4r.th1.bat""
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1288
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell -NoProfile -ExecutionPolicy Bypass -Command "$unsafe = [char[]](10,13,33,34,37,38,60,62,94,96,124); $rawNames = @('QWEN_INSTALL_METHOD','QWEN_INSTALL_MIRROR','QWEN_NO_MODIFY_PATH','QWEN_INSTALL_REPAIR_PATH','QWEN_INSTALL_PATH_SCOPE','QWEN_INSTALL_BASE_URL','QWEN_INSTALL_ARCHIVE','QWEN_INSTALL_VERSION','QWEN_NPM_REGISTRY','QWEN_INSTALL_ROOT','QWEN_INSTALL_LIB_DIR','QWEN_INSTALL_BIN_DIR','QWEN_INSTALL_GITHUB_REPO','QWEN_INSTALL_CURL_EXE'); foreach ($name in $rawNames) { $value = [Environment]::GetEnvironmentVariable($name); if ($null -ne $value -and $value.IndexOfAny($unsafe) -ge 0) { exit 1 } }; exit 0"
            3⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:468
          • C:\Windows\system32\whoami.exe
            whoami /user
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3740
          • C:\Windows\system32\findstr.exe
            findstr /i "S-1-5-18"
            3⤵
              PID:5476
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'Stop'; $file = Join-Path $env:TEMP ($env:QWEN_TEMP_FILE_PREFIX + '-' + [IO.Path]::GetRandomFileName() + $env:QWEN_TEMP_FILE_EXTENSION); New-Item -ItemType File -Path $file -ErrorAction Stop | Out-Null; [Console]::Write($file)"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:5704
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'Stop'; $file = Join-Path $env:TEMP ($env:QWEN_TEMP_FILE_PREFIX + '-' + [IO.Path]::GetRandomFileName() + $env:QWEN_TEMP_FILE_EXTENSION); New-Item -ItemType File -Path $file -ErrorAction Stop | Out-Null; [Console]::Write($file)"
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:5568
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\qwen-validate-options-4r5dwtqi.vwu.ps1"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2016
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell -NoProfile -ExecutionPolicy Bypass -Command "$value = $env:QWEN_VERSION_VALUE; if ($value -match '^v?[0-9]+\.[0-9]+\.[0-9]+([.-][A-Za-z0-9]+)*$') { exit 0 }; exit 1"
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:788
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'Stop'; $file = Join-Path $env:TEMP ($env:QWEN_TEMP_FILE_PREFIX + '-' + [IO.Path]::GetRandomFileName() + $env:QWEN_TEMP_FILE_EXTENSION); New-Item -ItemType File -Path $file -ErrorAction Stop | Out-Null; [Console]::Write($file)"
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:476
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference = 'Stop'; $file = Join-Path $env:TEMP ($env:QWEN_TEMP_FILE_PREFIX + '-' + [IO.Path]::GetRandomFileName() + $env:QWEN_TEMP_FILE_EXTENSION); New-Item -ItemType File -Path $file -ErrorAction Stop | Out-Null; [Console]::Write($file)"
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4180
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c where qwen 2>nul
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3340
              • C:\Windows\system32\where.exe
                where qwen
                4⤵
                  PID:5152
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c npm prefix -g 2>nul
                3⤵
                  PID:108
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c sort "C:\Users\Admin\AppData\Local\Temp\qwen-pre-install-vgo3t3ed.ivl" 2>nul | findstr /v "$"
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:256
                  • C:\Windows\system32\sort.exe
                    sort "C:\Users\Admin\AppData\Local\Temp\qwen-pre-install-vgo3t3ed.ivl"
                    4⤵
                      PID:252
                    • C:\Windows\system32\findstr.exe
                      findstr /v "$"
                      4⤵
                        PID:4768
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue'; $t=[int]$env:QWEN_RACE_TIMEOUT; try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 -bor [Net.SecurityProtocolType]::Tls13 } catch { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 }; function Probe($url) { try { $r = [Net.WebRequest]::Create($url); $r.Method = 'HEAD'; $r.Timeout = $t * 1000; if ($r -is [Net.HttpWebRequest]) { $r.AllowAutoRedirect = $true }; $resp = $r.GetResponse(); $resp.Close(); return $true } catch { return $false } }; if (Probe $env:QWEN_RACE_OSS_URL) { Write-Output 'aliyun'; exit 0 } elseif (Probe $env:QWEN_RACE_GH_URL) { Write-Output 'github'; exit 0 } else { Write-Output 'timeout'; exit 0 }"
                      3⤵
                      • System Time Discovery
                      • Suspicious use of WriteProcessMemory
                      PID:2264
                      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                        powershell -NoProfile -ExecutionPolicy Bypass -Command "$ErrorActionPreference='SilentlyContinue'; $t=[int]$env:QWEN_RACE_TIMEOUT; try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 -bor [Net.SecurityProtocolType]::Tls13 } catch { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 }; function Probe($url) { try { $r = [Net.WebRequest]::Create($url); $r.Method = 'HEAD'; $r.Timeout = $t * 1000; if ($r -is [Net.HttpWebRequest]) { $r.AllowAutoRedirect = $true }; $resp = $r.GetResponse(); $resp.Close(); return $true } catch { return $false } }; if (Probe $env:QWEN_RACE_OSS_URL) { Write-Output 'aliyun'; exit 0 } elseif (Probe $env:QWEN_RACE_GH_URL) { Write-Output 'github'; exit 0 } else { Write-Output 'timeout'; exit 0 }"
                        4⤵
                        • Badlisted process makes network request
                        • Command and Scripting Interpreter: PowerShell
                        • System Time Discovery
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1148
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -NoProfile -ExecutionPolicy Bypass -Command "try { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 -bor [Net.SecurityProtocolType]::Tls13 } catch { [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 }; function Test-QwenUrl($method, $range) { try { $request = [Net.WebRequest]::Create($env:QWEN_CHECK_URL); $request.Timeout = 10000; $request.Method = $method; if ($range) { $request.Headers.Add('Range', 'bytes=0-0') }; if ($request -is [Net.HttpWebRequest]) { $request.ReadWriteTimeout = 30000; $request.AllowAutoRedirect = $true }; $response = $request.GetResponse(); $response.Close(); return $true } catch { return $false } }; if (Test-QwenUrl 'HEAD' $false) { exit 0 }; if (Test-QwenUrl 'GET' $true) { exit 0 }; exit 1"
                      3⤵
                      • Badlisted process makes network request
                      • Command and Scripting Interpreter: PowerShell
                      • System Time Discovery
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1308
                    • C:\Windows\system32\where.exe
                      where node
                      3⤵
                        PID:3596
                  • C:\Windows\system32\sihost.exe
                    sihost.exe
                    1⤵
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of WriteProcessMemory
                    PID:3168
                    • C:\Windows\explorer.exe
                      explorer.exe /LOADSAVEDWINDOWS
                      2⤵
                      • Boot or Logon Autostart Execution: Active Setup
                      • Enumerates connected drives
                      • Checks SCSI registry key(s)
                      • Modifies Internet Explorer settings
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of FindShellTrayWindow
                      • Suspicious use of SendNotifyMessage
                      • Suspicious use of SetWindowsHookEx
                      PID:1704
                  • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                    "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                    1⤵
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:828
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                    • Modifies registry class
                    • Suspicious use of SetWindowsHookEx
                    PID:1948

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        ModuleAnalysisCache
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
                        • Size 67KB
                        • SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 948B
                        • SHA256 beb89f9355be2debcce3233a89ad4d63ec861b41b73c309d63444f4b800dc129
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 de35fcd8c9e432945eee3aa1321f7ebc548bd4154405d5f7f96f4e1083568111
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 948B
                        • SHA256 c1351c48803cd0e93a9d715bc584f175ed28504acf8f893c87128af5164a896c
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 948B
                        • SHA256 54b26da222ddf0a9d810f0939d544b43e01e438a6f5ec7db8d12f4a989dd1ada
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 b67191a152d4566d0194395342f55c6142d94005610603fdc92ac4d491519f82
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 1KB
                        • SHA256 120c6abb36026dc3f61f075430a1fd8c7068f9b74542306794e7b6d5d46d18c1
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        prep_Activatable Class_Hermes_perf.cache
                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                        • Size 603B
                        • SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        prep_Activatable Class_Hermes_perf.cache
                        • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                        • Size 599B
                        • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        __PSScriptPolicyTest_mom3iqme.53r.ps1
                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mom3iqme.53r.ps1
                        • Size 60B
                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        qwen-installation-SHA256SUMS-hehi2j4r.th1
                        • Path C:\Users\Admin\AppData\Local\Temp\qwen-installation-SHA256SUMS-hehi2j4r.th1
                        • Size 472B
                        • SHA256 dc938a034c41c5b9a4ab46c4409a1f9021120413e8df82610ceb29e7e2c40115
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        qwen-installer-hehi2j4r.th1.bat
                        • Path C:\Users\Admin\AppData\Local\Temp\qwen-installer-hehi2j4r.th1.bat
                        • Size 52KB
                        • SHA256 80d57a9a5bf3a9ee41b77c2a4a9be0e22a834f343533eae123f49487b25ef0e7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        qwen-validate-options-4r5dwtqi.vwu.ps1
                        • Path C:\Users\Admin\AppData\Local\Temp\qwen-validate-options-4r5dwtqi.vwu.ps1
                        • Size 396B
                        • SHA256 af8b6d73d561b3f9769ef9208d75be579b7d35e3707944d6bf5e0db375320a9f
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        memory/468-29-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/468-27-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/468-31-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/468-23-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/468-24-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/468-25-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/468-26-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/468-28-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/828-107-0x0000019202B50000-0x0000019202B70000-memory.dmp
                        Download

                        memory/828-91-0x00000192001E0000-0x00000192002E0000-memory.dmp
                        Download

                        memory/828-92-0x00000192001E0000-0x00000192002E0000-memory.dmp
                        Download

                        memory/828-93-0x00000192001E0000-0x00000192002E0000-memory.dmp
                        Download

                        memory/828-123-0x0000019202B70000-0x0000019202B90000-memory.dmp
                        Download

                        memory/828-108-0x0000019202E50000-0x0000019202F50000-memory.dmp
                        Download

                        memory/828-137-0x0000019214240000-0x0000019214260000-memory.dmp
                        Download

                        memory/1948-254-0x0000028D417A0000-0x0000028D41BD4000-memory.dmp
                        Download

                        memory/4780-8-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/4780-1-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/4780-7-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/4780-6-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/4780-65-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/4780-66-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/4780-5-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/4780-70-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/4780-4-0x000002AAE9CA0000-0x000002AAE9CC2000-memory.dmp
                        Download

                        memory/4780-19-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/4780-9-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/4780-10-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/4780-11-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/4780-16-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/4780-17-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/4780-18-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download

                        memory/4780-0-0x00007FFE6A04F000-0x00007FFE6A050000-memory.dmp
                        Download

                        memory/4780-20-0x00007FFE69EC0000-0x00007FFE6A864000-memory.dmp
                        Download