Overview

overview

7

Static

static

3

2026-08-10...ys.exe

windows10-2004-x64

7

2026-08-10...ys.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/08/2026, 05:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_f2012859a03c3a5878a44d21f6830d03_amadey_darkgate_elex_icedid_luca-stealer_njrat_rhadamanthys.exe
  • Size 21.3MB
  • Sample260810-genrsswygx
  • SHA256 140ff96e36ffcca9ba99be14e12e4ab96187477e79b7aeb7c74cb66e75d402e6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionransomwarespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 37 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 36 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 5 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_f2012859a03c3a5878a44d21f6830d03_amadey_darkgate_elex_icedid_luca-stealer_njrat_rhadamanthys.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_f2012859a03c3a5878a44d21f6830d03_amadey_darkgate_elex_icedid_luca-stealer_njrat_rhadamanthys.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Windows\SysWOW64\msiexec.exe
      msiexec.exe /x {D9FB7F91-9687-4B09-894D-072903CADEA4} /passive
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:632
    • C:\Windows\SysWOW64\msiexec.exe
      msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\QualcommWindowsDriverInstaller.msi"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:2672
  • C:\Windows\System32\alg.exe
    C:\Windows\System32\alg.exe
    1⤵
    • Executes dropped EXE
    PID:3824
  • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:2552
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
    1⤵
      PID:4900
    • C:\Windows\system32\fxssvc.exe
      C:\Windows\system32\fxssvc.exe
      1⤵
      • Executes dropped EXE
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:3836
    • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
      "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:1336
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 7A2E6615B0B86F01FB0CB659A657DB19 C
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3536
        • C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{94B2E8E4-6286-4E3E-A53D-0B9870AD5862}
          3⤵
          • Executes dropped EXE
          PID:2748
        • C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{B2118019-860E-4166-B534-FB9A6479350F}
          3⤵
          • Executes dropped EXE
          PID:1164
        • C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{C0F1C882-347D-4A6C-8699-D9AAFAE44A45}
          3⤵
          • Executes dropped EXE
          PID:4348
        • C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D734CAC4-226B-4F88-98A7-2D2D5B4E2700}
          3⤵
          • Executes dropped EXE
          PID:1224
        • C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9B016D40-E055-4E0F-81D8-B909BAAA13F2}
          3⤵
          • Executes dropped EXE
          PID:2472
        • C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3371212B-4538-439E-B4DE-0F199D506D53}
          3⤵
          • Executes dropped EXE
          PID:3472
        • C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{68EE5D6B-B93D-4397-AE7B-C4878E2C772B}
          3⤵
          • Executes dropped EXE
          PID:4156
        • C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{84425168-5A55-4DF8-A032-3BB3EBAF436E}
          3⤵
          • Executes dropped EXE
          PID:4960
        • C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0BCEC6FF-F70E-40C6-9A38-6DAD708EE621}
          3⤵
          • Executes dropped EXE
          PID:1872
        • C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{194B48E0-A9FE-4D2B-B6A3-14CFF94150BB}
          3⤵
          • Executes dropped EXE
          PID:372
        • C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe
          C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{9AB2BAFA-4FC7-4EF8-8889-A24B60B328C2}
          3⤵
          • Executes dropped EXE
          PID:2392
      • C:\Windows\system32\srtasks.exe
        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
        2⤵
          PID:2068
        • C:\Windows\syswow64\MsiExec.exe
          C:\Windows\syswow64\MsiExec.exe -Embedding AE73B2CCCD37E30FBE42E3F5E408958B E Global\MSI0000
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3056
          • C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\DriverInstaller64.exe
            "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\DriverInstaller64.exe" "/I|0|C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Checks SCSI registry key(s)
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:3736
            • C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Qdclr64.exe
              Qdclr64.exe
              4⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              PID:3992
            • \??\c:\windows\system32\cmd.exe
              c:\windows\system32\cmd.exe /C pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcfilter.inf"
              4⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:772
              • C:\Windows\system32\pnputil.exe
                pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcfilter.inf"
                5⤵
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                PID:940
            • \??\c:\windows\system32\cmd.exe
              c:\windows\system32\cmd.exe /C pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcser.inf"
              4⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5348
              • C:\Windows\system32\pnputil.exe
                pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcser.inf"
                5⤵
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                PID:5392
            • \??\c:\windows\system32\cmd.exe
              c:\windows\system32\cmd.exe /C pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcmdm.inf"
              4⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5684
              • C:\Windows\system32\pnputil.exe
                pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcmdm.inf"
                5⤵
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                PID:5728
            • \??\c:\windows\system32\cmd.exe
              c:\windows\system32\cmd.exe /C pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcwwan.inf"
              4⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5996
              • C:\Windows\system32\pnputil.exe
                pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcwwan.inf"
                5⤵
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                PID:6048
            • \??\c:\windows\system32\cmd.exe
              c:\windows\system32\cmd.exe /C pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qdbusb.inf"
              4⤵
              • Executes a command shell one-liner
              • Suspicious use of WriteProcessMemory
              PID:5324
              • C:\Windows\system32\pnputil.exe
                pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qdbusb.inf"
                5⤵
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                PID:4952
      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
        1⤵
        • Executes dropped EXE
        PID:3804
      • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
        1⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        PID:1056
      • C:\Windows\System32\msdtc.exe
        C:\Windows\System32\msdtc.exe
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Drops file in Windows directory
        PID:4792
      • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
        "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
        1⤵
        • Executes dropped EXE
        PID:2604
      • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
        1⤵
        • Executes dropped EXE
        PID:3416
      • C:\Windows\SysWow64\perfhost.exe
        C:\Windows\SysWow64\perfhost.exe
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:260
      • C:\Windows\system32\locator.exe
        C:\Windows\system32\locator.exe
        1⤵
        • Executes dropped EXE
        PID:4852
      • C:\Windows\System32\SensorDataService.exe
        C:\Windows\System32\SensorDataService.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:756
      • C:\Windows\System32\snmptrap.exe
        C:\Windows\System32\snmptrap.exe
        1⤵
        • Executes dropped EXE
        PID:2624
      • C:\Windows\system32\spectrum.exe
        C:\Windows\system32\spectrum.exe
        1⤵
        • Executes dropped EXE
        • Checks SCSI registry key(s)
        PID:2060
      • C:\Windows\System32\OpenSSH\ssh-agent.exe
        C:\Windows\System32\OpenSSH\ssh-agent.exe
        1⤵
        • Executes dropped EXE
        PID:1084
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
        1⤵
          PID:3392
        • C:\Windows\system32\TieringEngineService.exe
          C:\Windows\system32\TieringEngineService.exe
          1⤵
          • Executes dropped EXE
          • Checks processor information in registry
          PID:3100
        • C:\Windows\system32\AgentService.exe
          C:\Windows\system32\AgentService.exe
          1⤵
          • Executes dropped EXE
          PID:1108
        • C:\Windows\System32\vds.exe
          C:\Windows\System32\vds.exe
          1⤵
          • Executes dropped EXE
          PID:2760
        • C:\Windows\system32\vssvc.exe
          C:\Windows\system32\vssvc.exe
          1⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          PID:3996
        • C:\Windows\system32\wbengine.exe
          "C:\Windows\system32\wbengine.exe"
          1⤵
          • Executes dropped EXE
          PID:4584
        • C:\Windows\system32\wbem\WmiApSrv.exe
          C:\Windows\system32\wbem\WmiApSrv.exe
          1⤵
          • Executes dropped EXE
          PID:3120
        • C:\Windows\system32\SearchIndexer.exe
          C:\Windows\system32\SearchIndexer.exe /Embedding
          1⤵
          • Executes dropped EXE
          • Modifies data under HKEY_USERS
          • Suspicious use of WriteProcessMemory
          PID:3836
          • C:\Windows\system32\SearchProtocolHost.exe
            "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:1604
          • C:\Windows\system32\SearchFilterHost.exe
            "C:\Windows\system32\SearchFilterHost.exe" 0 800 804 812 8192 808 784
            2⤵
            • Modifies data under HKEY_USERS
            PID:4448
        • C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Tools\qcmtusvc.exe
          "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Tools\qcmtusvc.exe"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:3148
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
          1⤵
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of WriteProcessMemory
          PID:2740
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{e38b7e4c-b802-c04d-a87f-b66e4d699e1f}\qcfilter.inf" "9" "4f20a334b" "0000000000000144" "WinSta0\Default" "0000000000000158" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10"
            2⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:1992
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{642203c4-e2ef-f64a-b38b-b3ec3865fd85}\qcser.inf" "9" "4a2d6f58f" "0000000000000158" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10"
            2⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:5468
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{042a3d82-64a7-e24e-ac7e-dc428c2bafc5}\qcmdm.inf" "9" "45d7b755f" "000000000000015C" "WinSta0\Default" "0000000000000154" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10"
            2⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Modifies data under HKEY_USERS
            PID:5788
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{34705959-805c-ce4d-9d53-2394667dcb2d}\qcwwan.inf" "9" "47d43915b" "0000000000000154" "WinSta0\Default" "0000000000000144" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10"
            2⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:6112
          • C:\Windows\system32\DrvInst.exe
            DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{daa469ea-8ba1-f04e-825e-38862b763d17}\qdbusb.inf" "9" "4ffbb3ea7" "0000000000000180" "WinSta0\Default" "0000000000000154" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10"
            2⤵
            • Drops file in System32 directory
            • Drops file in Windows directory
            • Checks SCSI registry key(s)
            • Modifies data under HKEY_USERS
            PID:940
        • C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Tools\qcmtusvc.exe
          "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Tools\qcmtusvc.exe"
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:5472

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              e591535.rbs
              • Path C:\Config.Msi\e591535.rbs
              • Size 39KB
              • SHA256 c7a4e2370b609bb7388f1d598fbb2a128555fdfad6b0b4db73a1278e3b7a6b56
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qcusbfilter.sys
              • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\WINDOW~1\filter\amd64\qcusbfilter.sys
              • Size 62KB
              • SHA256 b82ec37d0f1f32a5c0b7692c5eb994a94bdbd32b405f507be30f20af6507799e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qcfilter.cat
              • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\WINDOW~1\qcfilter.cat
              • Size 102KB
              • SHA256 085d92a615a847fcab82ae51084fdc5a059bc1e3b1a4c46e16a5b7a6f38f8cd8
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qcser.cat
              • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\WINDOW~1\qcser.cat
              • Size 102KB
              • SHA256 a6d69612bbc0ba08d8acec96452bf500fe3deb5d22ad4f96df8d1ad8a8bd3677
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qcusbser.sys
              • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\WINDOW~1\serial\amd64\qcusbser.sys
              • Size 255KB
              • SHA256 b5a5ad91ba480a5d5beaa0b6858b6c1c3a0c231af8979cfdcdb27b1c869bed6a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
              • Size 2.7MB
              • SHA256 1c948e294f32dc0359cd56bde2d361060d0780cfb62223f86b66bb1c08199d7e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              maintenanceservice.exe
              • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
              • Size 826KB
              • SHA256 05995781e4c1bbfe803fc8d60d25fc6dcf5c7d280fb2a15a15af212485a47138
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DriverInstaller64.exe
              • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\DriverInstaller64.exe
              • Size 1.9MB
              • SHA256 997f5886a8a1e1a39cf440b1e1f5e5430592632e07e4d4a6fc7845dfc1842953
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qcmtusvc.exe
              • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Tools\qcmtusvc.exe
              • Size 128KB
              • SHA256 16cc84d860854714ec0c256a53668c9228b216b20fd7d8769e1ac65aa187c4cf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qcfilter.inf
              • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcfilter.inf
              • Size 141KB
              • SHA256 05740e397d579de61ff678a16a5be6ec7a15d6857d62c443f446dcf73366d1f9
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qcser.inf
              • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcser.inf
              • Size 191KB
              • SHA256 6c00625f563ebf250f875a2ed61e599aa08602e2e9f72e53d6570169b4547568
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qdclr64.exe
              • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\qdclr64.exe
              • Size 128KB
              • SHA256 3ebcbbde1fce92b85c67b82d5884287faf6c33c57c8299ba414547ac6d82ecf4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              OSE.EXE
              • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
              • Size 805KB
              • SHA256 89085ce746550bc87e40392d5d84ffc45d5b0d216dd8ec67b1f7b61c89ec10f4
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              elevation_service.exe
              • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
              • Size 2.8MB
              • SHA256 8174cf67a0daca1864d210c8599832dec29c599c5b67db11561aa9277e9a27a7
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSI4FC1.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\MSI4FC1.tmp
              • Size 1.3MB
              • SHA256 6b7dee440fbcde1b0a2a98d4b406b941c97154204fa0e7c79c250e01eec24c2f
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              QualcommWindowsDriverInstaller.msi
              • Path C:\Users\Admin\AppData\Local\Temp\QualcommWindowsDriverInstaller.msi
              • Size 19.0MB
              • SHA256 3a39d500f83754feaba714fb967231b40223a7cf94af3e30f71c01f329e0e33d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qcmdm.inf
              • Path C:\Users\Admin\AppData\Local\Temp\{042a3d82-64a7-e24e-ac7e-dc428c2bafc5}\qcmdm.inf
              • Size 67KB
              • SHA256 2282e75ea1801093e718d01d3f3d8809dab05593bc1a6528453d3e9e981a5486
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              qcwwan.inf
              • Path C:\Users\Admin\AppData\Local\Temp\{34705959-805c-ce4d-9d53-2394667dcb2d}\qcwwan.inf
              • Size 113KB
              • SHA256 a3e18a24716acfb38c6c92a891c4999dafc95bcb3798b6367b2a054ae3c83596
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ISBEW64.exe
              • Path C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISBEW64.exe
              • Size 146KB
              • SHA256 9acc6cb5d01a4e4dbc92c8774c6999fab5f0e49f097e83098ba740842f5a2894
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ISRT.dll
              • Path C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\ISRT.dll
              • Size 260KB
              • SHA256 e91a865c3d60d9d0bce5d5a0a2f551c5e032d5bc13bc40f85091ce46d38064e0
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              _isres_0x0409.dll
              • Path C:\Users\Admin\AppData\Local\Temp\{B1BA07D0-EFDC-41FD-B35C-0D9BDEA94997}\_isres_0x0409.dll
              • Size 540KB
              • SHA256 6366e18a8cbf609c9573f341004e5c2725c23a12973affa90ee7bcc7934ae1b2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSI2060.tmp
              • Path C:\Windows\Installer\MSI2060.tmp
              • Size 1.9MB
              • SHA256 19cdeee571a547c206e9ac08698194becd9afc767083708e36e752a6232bc2ea
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              perfhost.exe
              • Path C:\Windows\SysWOW64\perfhost.exe
              • Size 588KB
              • SHA256 0e7560415a1227ef35129e117d3b808a5326826bec8ce7a47a1c295e54d71f77
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              AgentService.exe
              • Path C:\Windows\System32\AgentService.exe
              • Size 1.7MB
              • SHA256 644ea9ffc2783c82ea4ae8d2236e1136fd2b9a7b9ed3c60898a6b4a2eb8305fa
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              DiagnosticsHub.StandardCollector.Service.exe
              • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
              • Size 659KB
              • SHA256 357aa505a03dfb24c1e3e846720ddc57e5405091e3f88e1f87ab98001afb659d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SET3B0C.tmp
              • Path C:\Windows\System32\DriverStore\Temp\{92337ffb-cae2-2743-aad0-51320ebe2e3d}\SET3B0C.tmp
              • Size 101KB
              • SHA256 ae67711e588a4ab6ea7745abd82f3e8a3e68c7cd1ae734399e2025b189bb0806
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SET3B1D.tmp
              • Path C:\Windows\System32\DriverStore\Temp\{92337ffb-cae2-2743-aad0-51320ebe2e3d}\SET3B1D.tmp
              • Size 31KB
              • SHA256 7f3b800bb0a6a31d07fda876961d06c2836228092b9e8402b9ba2c1e1a047f3e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SET3B0B.tmp
              • Path C:\Windows\System32\DriverStore\Temp\{92337ffb-cae2-2743-aad0-51320ebe2e3d}\qdss\amd64\SET3B0B.tmp
              • Size 68KB
              • SHA256 ebc940ed07ce5a2753b5bb32166d7520a594390ccdb6d89efa34debd2dfcdf2d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SET37EF.tmp
              • Path C:\Windows\System32\DriverStore\Temp\{d10198da-0115-8040-abf2-a1953c217955}\SET37EF.tmp
              • Size 40KB
              • SHA256 46b67bff8d9a19ece01b191872692ae0c1e4a2844c0ce1614880532fd4468dfe
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SET37F0.tmp
              • Path C:\Windows\System32\DriverStore\Temp\{d10198da-0115-8040-abf2-a1953c217955}\ndis\6.2\amd64\SET37F0.tmp
              • Size 551KB
              • SHA256 e7f2c8cababd799ed1dc968b862ab1347fa46034cae4bffaa8e8c087003516f2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              FXSSVC.exe
              • Path C:\Windows\System32\FXSSVC.exe
              • Size 1.2MB
              • SHA256 8fde6f46ab18dde7fc144c9002f49ed6d426e91d72862577b3a2bf2ce71ff679
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Locator.exe
              • Path C:\Windows\System32\Locator.exe
              • Size 578KB
              • SHA256 54800d292a566f838bf38f5e88b5087aadcdce801310edd4c7392bb31f0a4d15
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              ssh-agent.exe
              • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
              • Size 940KB
              • SHA256 c23c4cce38d31c6fa509aa1bebfcf18cdc8dcc0c0296c0f4bcd57578aba28c6d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              PerceptionSimulationService.exe
              • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
              • Size 671KB
              • SHA256 77d1bdf948c6ea0d7effab8cab3f01af520c8cb4236467489bb2592f4361fc05
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SearchIndexer.exe
              • Path C:\Windows\System32\SearchIndexer.exe
              • Size 1.4MB
              • SHA256 c29ed0a9c036b75d947cdacd0f864de5b07d18b67e1a2c9674682e493ff116e5
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              SensorDataService.exe
              • Path C:\Windows\System32\SensorDataService.exe
              • Size 1.8MB
              • SHA256 79e6b4ae27576ad359fdf255bb2e2d0d69b76251443f87cec111e760e4da9dd2
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              Spectrum.exe
              • Path C:\Windows\System32\Spectrum.exe
              • Size 1.4MB
              • SHA256 6a28237650c5ef46054be21ceba5481a98772a8037f1ffef8c2356a522ab5a1e
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              TieringEngineService.exe
              • Path C:\Windows\System32\TieringEngineService.exe
              • Size 885KB
              • SHA256 d4f4442101190e219879dd4f227636b11617057a8f85313f211556155b609d12
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              VSSVC.exe
              • Path C:\Windows\System32\VSSVC.exe
              • Size 2.0MB
              • SHA256 335f1c5f0afb33d3b418b4f20f882a66cff218b899d0bd55a43d3276d6830570
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              alg.exe
              • Path C:\Windows\System32\alg.exe
              • Size 661KB
              • SHA256 4591478751b6d100ed4c6fd00f2fb0472cabba76632e19dca5e41d44f6eb0b3d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              dberr.txt
              • Path C:\Windows\System32\catroot2\dberr.txt
              • Size 40KB
              • SHA256 7bc6e72a1e697be263201d592b1e9eb38c0f4b5d9c51113a8d78bec23021a9bf
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              msdtc.exe
              • Path C:\Windows\System32\msdtc.exe
              • Size 712KB
              • SHA256 09048b5ffb4e045e552a14a303520d29d9594d05e4e017cb2ee2fced68799b1a
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              snmptrap.exe
              • Path C:\Windows\System32\snmptrap.exe
              • Size 584KB
              • SHA256 1777e41f26b3f1e2754dd6eb0cf7f0e84b95fcbb2c82ae1f498a60576320568d
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              vds.exe
              • Path C:\Windows\System32\vds.exe
              • Size 1.3MB
              • SHA256 9ed6c55b08725aa6892710cd43758b3a6734eeef1be9f8efa012f60fec8e4854
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              WmiApSrv.exe
              • Path C:\Windows\System32\wbem\WmiApSrv.exe
              • Size 772KB
              • SHA256 4c0afeddea3988c55fea95ffe5dd5db249e5c257cee626bd5b2bf5dc968c5487
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              wbengine.exe
              • Path C:\Windows\System32\wbengine.exe
              • Size 2.1MB
              • SHA256 12e13e372336b9c9163cd9fb44b2a55c6ee3944c047c630aeb3479c54331f438
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              memory/260-100-0x0000000000670000-0x00000000006D6000-memory.dmp
              Download

              memory/260-105-0x0000000000670000-0x00000000006D6000-memory.dmp
              Download

              memory/260-178-0x0000000000400000-0x0000000000497000-memory.dmp
              Download

              memory/260-109-0x0000000000400000-0x0000000000497000-memory.dmp
              Download

              memory/756-187-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/756-405-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/756-115-0x0000000140000000-0x00000001401D7000-memory.dmp
              Download

              memory/1056-64-0x0000000140000000-0x00000001400D5000-memory.dmp
              Download

              memory/1056-67-0x0000000001A80000-0x0000000001AE0000-memory.dmp
              Download

              memory/1056-62-0x0000000001A80000-0x0000000001AE0000-memory.dmp
              Download

              memory/1056-56-0x0000000001A80000-0x0000000001AE0000-memory.dmp
              Download

              memory/1056-69-0x0000000140000000-0x00000001400D5000-memory.dmp
              Download

              memory/1084-161-0x0000000140000000-0x0000000140102000-memory.dmp
              Download

              memory/1084-153-0x0000000000C60000-0x0000000000CC0000-memory.dmp
              Download

              memory/1084-333-0x0000000140000000-0x0000000140102000-memory.dmp
              Download

              memory/1084-159-0x0000000000C60000-0x0000000000CC0000-memory.dmp
              Download

              memory/1108-171-0x0000000140000000-0x00000001401C0000-memory.dmp
              Download

              memory/1108-169-0x0000000140000000-0x00000001401C0000-memory.dmp
              Download

              memory/1336-125-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/1336-38-0x0000000000C50000-0x0000000000CB0000-memory.dmp
              Download

              memory/1336-32-0x0000000000C50000-0x0000000000CB0000-memory.dmp
              Download

              memory/1336-40-0x0000000140000000-0x00000001402E9000-memory.dmp
              Download

              memory/2060-139-0x00000000004D0000-0x0000000000530000-memory.dmp
              Download

              memory/2060-128-0x00000000004D0000-0x0000000000530000-memory.dmp
              Download

              memory/2060-207-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/2060-142-0x0000000140000000-0x0000000140169000-memory.dmp
              Download

              memory/2488-5-0x00000000036C0000-0x0000000003726000-memory.dmp
              Download

              memory/2488-9-0x0000000000400000-0x000000000195C000-memory.dmp
              Download

              memory/2488-925-0x0000000000400000-0x000000000195C000-memory.dmp
              Download

              memory/2488-72-0x0000000000400000-0x000000000195C000-memory.dmp
              Download

              memory/2488-0-0x00000000036C0000-0x0000000003726000-memory.dmp
              Download

              memory/2552-24-0x0000000140000000-0x00000001400A9000-memory.dmp
              Download

              memory/2552-16-0x00000000006B0000-0x0000000000710000-memory.dmp
              Download

              memory/2552-108-0x0000000140000000-0x00000001400A9000-memory.dmp
              Download

              memory/2552-25-0x00000000006B0000-0x0000000000710000-memory.dmp
              Download

              memory/2604-75-0x00000000007A0000-0x0000000000800000-memory.dmp
              Download

              memory/2604-81-0x00000000007A0000-0x0000000000800000-memory.dmp
              Download

              memory/2604-84-0x0000000140000000-0x00000001400CF000-memory.dmp
              Download

              memory/2604-168-0x0000000140000000-0x00000001400CF000-memory.dmp
              Download

              memory/2624-197-0x0000000140000000-0x0000000140096000-memory.dmp
              Download

              memory/2624-121-0x0000000140000000-0x0000000140096000-memory.dmp
              Download

              memory/2760-404-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/2760-175-0x0000000140000000-0x0000000140147000-memory.dmp
              Download

              memory/3100-164-0x0000000140000000-0x00000001400E2000-memory.dmp
              Download

              memory/3100-375-0x0000000140000000-0x00000001400E2000-memory.dmp
              Download

              memory/3120-460-0x0000000140000000-0x00000001400C6000-memory.dmp
              Download

              memory/3120-188-0x0000000140000000-0x00000001400C6000-memory.dmp
              Download

              memory/3416-92-0x00000000004F0000-0x0000000000550000-memory.dmp
              Download

              memory/3416-174-0x0000000140000000-0x00000001400AB000-memory.dmp
              Download

              memory/3416-86-0x00000000004F0000-0x0000000000550000-memory.dmp
              Download

              memory/3416-95-0x0000000140000000-0x00000001400AB000-memory.dmp
              Download

              memory/3536-198-0x0000000003750000-0x00000000037F7000-memory.dmp
              Download

              memory/3536-407-0x0000000003750000-0x00000000037F7000-memory.dmp
              Download

              memory/3536-406-0x0000000010000000-0x00000000101B5000-memory.dmp
              Download

              memory/3536-126-0x0000000010000000-0x00000000101B5000-memory.dmp
              Download

              memory/3536-204-0x0000000003920000-0x00000000039A9000-memory.dmp
              Download

              memory/3804-136-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/3804-49-0x0000000000890000-0x00000000008F0000-memory.dmp
              Download

              memory/3804-51-0x0000000140000000-0x00000001402D4000-memory.dmp
              Download

              memory/3804-43-0x0000000000890000-0x00000000008F0000-memory.dmp
              Download

              memory/3824-107-0x0000000140000000-0x00000001400AA000-memory.dmp
              Download

              memory/3824-12-0x0000000140000000-0x00000001400AA000-memory.dmp
              Download

              memory/3836-251-0x0000000009E60000-0x0000000009E68000-memory.dmp
              Download

              memory/3836-208-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/3836-218-0x0000000001770000-0x0000000001780000-memory.dmp
              Download

              memory/3836-234-0x0000000001A20000-0x0000000001A30000-memory.dmp
              Download

              memory/3836-52-0x0000000140000000-0x0000000140135000-memory.dmp
              Download

              memory/3836-29-0x0000000140000000-0x0000000140135000-memory.dmp
              Download

              memory/3836-409-0x000000000C950000-0x000000000C958000-memory.dmp
              Download

              memory/3836-498-0x0000000140000000-0x0000000140179000-memory.dmp
              Download

              memory/3996-179-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/3996-408-0x0000000140000000-0x00000001401FC000-memory.dmp
              Download

              memory/4448-427-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-432-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-443-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-442-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-441-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-448-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-447-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-446-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-445-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-444-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-439-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-438-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-419-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-437-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-436-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-435-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-434-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-430-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-428-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-422-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-431-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-440-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-433-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-412-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-429-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-423-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-425-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-426-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-413-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-424-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-421-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-420-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-418-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-415-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-416-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-414-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4448-417-0x0000026CF08F0000-0x0000026CF0900000-memory.dmp
              Download

              memory/4584-184-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/4584-411-0x0000000140000000-0x0000000140216000-memory.dmp
              Download

              memory/4792-73-0x0000000140000000-0x00000001400B9000-memory.dmp
              Download

              memory/4852-183-0x0000000140000000-0x0000000140095000-memory.dmp
              Download

              memory/4852-112-0x0000000140000000-0x0000000140095000-memory.dmp
              Download

              memory/5472-924-0x0000000000400000-0x0000000000771000-memory.dmp
              Download

              memory/5472-928-0x0000000000400000-0x0000000000771000-memory.dmp
              Download