Overview

overview

7

Static

static

3

2026-08-10...ys.exe

windows10-2004-x64

7

2026-08-10...ys.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/08/2026, 05:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-10_f2012859a03c3a5878a44d21f6830d03_amadey_darkgate_elex_icedid_luca-stealer_njrat_rhadamanthys.exe
  • Size 21.3MB
  • Sample260810-genrsswygx
  • SHA256 140ff96e36ffcca9ba99be14e12e4ab96187477e79b7aeb7c74cb66e75d402e6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryexecutionransomwarespywarestealer

Malware Config

Signatures

  • Executes dropped EXE 27 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 38 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 5 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 25 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 35 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-10_f2012859a03c3a5878a44d21f6830d03_amadey_darkgate_elex_icedid_luca-stealer_njrat_rhadamanthys.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_f2012859a03c3a5878a44d21f6830d03_amadey_darkgate_elex_icedid_luca-stealer_njrat_rhadamanthys.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:5696
    • C:\Windows\SysWOW64\msiexec.exe
      msiexec.exe /x {D9FB7F91-9687-4B09-894D-072903CADEA4} /passive
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:2212
    • C:\Windows\SysWOW64\msiexec.exe
      msiexec.exe /i "C:\Users\Admin\AppData\Local\Temp\QualcommWindowsDriverInstaller.msi"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:4916
  • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
    "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    PID:4244
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2940
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding B59B24C6E17D35483975F65C0560C948 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:824
      • C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4A3DD64D-15FC-4046-A7B8-3E2EC379AB4F}
        3⤵
        • Executes dropped EXE
        PID:4804
      • C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6627885E-2231-43F5-8980-D5092CBEF34D}
        3⤵
        • Executes dropped EXE
        PID:3612
      • C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{332F9C01-2DCB-48F5-A64A-5AED616F44BF}
        3⤵
        • Executes dropped EXE
        PID:4840
      • C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{7E315A93-15EF-4A85-8098-D749192317E3}
        3⤵
        • Executes dropped EXE
        PID:2680
      • C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{97CFCDFA-CCC0-4922-9AC9-3F5D8616FA45}
        3⤵
        • Executes dropped EXE
        PID:5996
      • C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{49B955A6-7127-490F-86D2-33FB519775B1}
        3⤵
        • Executes dropped EXE
        PID:2848
      • C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6280040E-9D1D-4A7C-8010-364D414E13A3}
        3⤵
        • Executes dropped EXE
        PID:6000
      • C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{14D747E7-368E-469D-B71A-909E40F98DE0}
        3⤵
        • Executes dropped EXE
        PID:3332
      • C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5757E4C1-9F89-4778-9556-A5C52312E33E}
        3⤵
        • Executes dropped EXE
        PID:2460
      • C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{FD68FF7D-CF8A-4EA2-A9D8-CCF508BBAD7B}
        3⤵
        • Executes dropped EXE
        PID:2752
      • C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{0948D5E3-2006-41CA-A7A7-E027344B80E5}
        3⤵
        • Executes dropped EXE
        PID:4428
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
        PID:2372
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 9A125DAD63539D91D98161096FF80364 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:616
        • C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\DriverInstaller64.exe
          "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\DriverInstaller64.exe" "/I|0|C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Checks SCSI registry key(s)
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2828
          • C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Qdclr64.exe
            Qdclr64.exe
            4⤵
            • Executes dropped EXE
            • Checks SCSI registry key(s)
            PID:1168
          • \??\c:\windows\system32\cmd.exe
            c:\windows\system32\cmd.exe /C pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcfilter.inf"
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:1340
            • C:\Windows\system32\pnputil.exe
              pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcfilter.inf"
              5⤵
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              PID:1480
          • \??\c:\windows\system32\cmd.exe
            c:\windows\system32\cmd.exe /C pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcser.inf"
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:3636
            • C:\Windows\system32\pnputil.exe
              pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcser.inf"
              5⤵
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              PID:2088
          • \??\c:\windows\system32\cmd.exe
            c:\windows\system32\cmd.exe /C pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcmdm.inf"
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:2736
            • C:\Windows\system32\pnputil.exe
              pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcmdm.inf"
              5⤵
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              PID:6080
          • \??\c:\windows\system32\cmd.exe
            c:\windows\system32\cmd.exe /C pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcwwan.inf"
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:476
            • C:\Windows\system32\pnputil.exe
              pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcwwan.inf"
              5⤵
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              PID:1332
          • \??\c:\windows\system32\cmd.exe
            c:\windows\system32\cmd.exe /C pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qdbusb.inf"
            4⤵
            • Executes a command shell one-liner
            • Suspicious use of WriteProcessMemory
            PID:4400
            • C:\Windows\system32\pnputil.exe
              pnputil -i -a "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qdbusb.inf"
              5⤵
              • Drops file in Windows directory
              • Checks SCSI registry key(s)
              PID:1436
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
      • Executes dropped EXE
      PID:3384
    • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
      "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
      1⤵
      • Executes dropped EXE
      PID:296
    • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
      "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
      1⤵
      • Executes dropped EXE
      PID:612
    • C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
      1⤵
      • Executes dropped EXE
      PID:4568
    • C:\Windows\SysWow64\perfhost.exe
      C:\Windows\SysWow64\perfhost.exe
      1⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1184
    • C:\Windows\System32\ReFsDedupSvc.exe
      C:\Windows\System32\ReFsDedupSvc.exe
      1⤵
      • Executes dropped EXE
      • Checks processor information in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:2400
    • C:\Windows\System32\SensorDataService.exe
      C:\Windows\System32\SensorDataService.exe
      1⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      PID:4816
    • C:\Windows\System32\OpenSSH\ssh-agent.exe
      C:\Windows\System32\OpenSSH\ssh-agent.exe
      1⤵
      • Executes dropped EXE
      PID:3404
    • C:\Windows\system32\AgentService.exe
      C:\Windows\system32\AgentService.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2956
    • C:\Windows\system32\SearchIndexer.exe
      C:\Windows\system32\SearchIndexer.exe /Embedding
      1⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4964
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
        2⤵
        • Modifies data under HKEY_USERS
        PID:1144
      • C:\Windows\System32\SearchProtocolHost.exe
        "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002_ Global\UsGthrCtrlFltPipeMssGthrPipe_S-1-5-21-1875162379-3804078649-638427191-10002 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon" "1"
        2⤵
          PID:5760
        • C:\Windows\System32\SearchFilterHost.exe
          "C:\Windows\System32\SearchFilterHost.exe" 944 2992 2996 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
          2⤵
            PID:772
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 944 3040 2972 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
            2⤵
            • Modifies data under HKEY_USERS
            PID:3540
          • C:\Windows\System32\SearchProtocolHost.exe
            "C:\Windows\System32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe3_ Global\UsGthrCtrlFltPipeMssGthrPipe3 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
            2⤵
            • Modifies data under HKEY_USERS
            PID:2752
          • C:\Windows\System32\SearchFilterHost.exe
            "C:\Windows\System32\SearchFilterHost.exe" 944 2992 2996 928 {7FC3863B-7471-4B10-84E3-A5C2E0330618}
            2⤵
              PID:3380
            • C:\Windows\System32\SearchFilterHost.exe
              "C:\Windows\System32\SearchFilterHost.exe" 944 3040 2972 928 {06DC0F6A-A3E7-4365-A8E8-F674FE2E6361}
              2⤵
                PID:4888
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k GPSvcGroup
              1⤵
                PID:868
              • C:\Windows\system32\vssvc.exe
                C:\Windows\system32\vssvc.exe
                1⤵
                • Executes dropped EXE
                • Checks SCSI registry key(s)
                PID:4732
              • C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Tools\qcmtusvc.exe
                "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Tools\qcmtusvc.exe"
                1⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3036
              • C:\Windows\system32\DrvInst.exe
                DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{12571c79-abfe-1342-995e-8520242fd2d0}\qcfilter.inf" "9" "4f20a334b" "00000000000000E0" "WinSta0\Default" "000000000000016C" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10"
                1⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                • Modifies data under HKEY_USERS
                PID:3508
              • C:\Windows\system32\DrvInst.exe
                DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{af331d2a-3afa-9548-ba3b-290dd4e9461b}\qcser.inf" "9" "4a2d6f58f" "0000000000000194" "WinSta0\Default" "0000000000000198" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10"
                1⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                • Modifies data under HKEY_USERS
                PID:3856
              • C:\Windows\system32\DrvInst.exe
                DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{1b99a592-d6fc-2244-bc98-3b9b2f7fcef0}\qcmdm.inf" "9" "45d7b755f" "0000000000000198" "WinSta0\Default" "0000000000000184" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10"
                1⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                • Modifies data under HKEY_USERS
                PID:3084
              • C:\Windows\system32\DrvInst.exe
                DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{e296e80c-1280-364f-9355-31d7ff51a03d}\qcwwan.inf" "9" "47d43915b" "0000000000000184" "WinSta0\Default" "0000000000000114" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10"
                1⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                • Modifies data under HKEY_USERS
                PID:4228
              • C:\Windows\system32\DrvInst.exe
                DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{8a57542f-ad3d-a340-99b8-9061f33f297f}\qdbusb.inf" "9" "4ffbb3ea7" "0000000000000114" "WinSta0\Default" "0000000000000194" "208" "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10"
                1⤵
                • Drops file in System32 directory
                • Drops file in Windows directory
                • Checks SCSI registry key(s)
                • Modifies data under HKEY_USERS
                PID:5932
              • C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Tools\qcmtusvc.exe
                "C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Tools\qcmtusvc.exe"
                1⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:4072

              Network

                    MITRE ATT&CK Enterprise v16

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    e5a6719.rbs
                    • Path C:\Config.Msi\e5a6719.rbs
                    • Size 39KB
                    • SHA256 26639782faed90d899b3e5ebbcceb996beae17d875d441b9476a30cc41cefd95
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qcusbfilter.sys
                    • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\WINDOW~1\filter\amd64\qcusbfilter.sys
                    • Size 62KB
                    • SHA256 b82ec37d0f1f32a5c0b7692c5eb994a94bdbd32b405f507be30f20af6507799e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qcusbwwan.sys
                    • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\WINDOW~1\ndis\6.2\amd64\qcusbwwan.sys
                    • Size 551KB
                    • SHA256 e7f2c8cababd799ed1dc968b862ab1347fa46034cae4bffaa8e8c087003516f2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qcfilter.cat
                    • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\WINDOW~1\qcfilter.cat
                    • Size 102KB
                    • SHA256 085d92a615a847fcab82ae51084fdc5a059bc1e3b1a4c46e16a5b7a6f38f8cd8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qcser.cat
                    • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\WINDOW~1\qcser.cat
                    • Size 102KB
                    • SHA256 a6d69612bbc0ba08d8acec96452bf500fe3deb5d22ad4f96df8d1ad8a8bd3677
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qcwwan.cat
                    • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\WINDOW~1\qcwwan.cat
                    • Size 40KB
                    • SHA256 46b67bff8d9a19ece01b191872692ae0c1e4a2844c0ce1614880532fd4468dfe
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qdbusb.cat
                    • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\WINDOW~1\qdbusb.cat
                    • Size 101KB
                    • SHA256 ae67711e588a4ab6ea7745abd82f3e8a3e68c7cd1ae734399e2025b189bb0806
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qdbusb.sys
                    • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\WINDOW~1\qdss\amd64\qdbusb.sys
                    • Size 68KB
                    • SHA256 ebc940ed07ce5a2753b5bb32166d7520a594390ccdb6d89efa34debd2dfcdf2d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qcusbser.sys
                    • Path C:\PROGRA~2\QUALCO~1\QUALCO~1\DRIVER~1\Qualcomm\fre\WINDOW~1\serial\amd64\qcusbser.sys
                    • Size 255KB
                    • SHA256 b5a5ad91ba480a5d5beaa0b6858b6c1c3a0c231af8979cfdcdb27b1c869bed6a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    elevation_service.exe
                    • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                    • Size 2.7MB
                    • SHA256 a1a13f0e48a159e6944597b52d35fe1d9c8ee40f94a378b31d961fbf248af38e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    maintenanceservice.exe
                    • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                    • Size 826KB
                    • SHA256 0be51377cfdb50ea430fd87619c6aed0fcd43afb52ada0e1b4a219dbb282a630
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    DriverInstaller64.exe
                    • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\DriverInstaller64.exe
                    • Size 1.9MB
                    • SHA256 997f5886a8a1e1a39cf440b1e1f5e5430592632e07e4d4a6fc7845dfc1842953
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qcmtusvc.exe
                    • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\Tools\qcmtusvc.exe
                    • Size 128KB
                    • SHA256 16cc84d860854714ec0c256a53668c9228b216b20fd7d8769e1ac65aa187c4cf
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qcfilter.inf
                    • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcfilter.inf
                    • Size 141KB
                    • SHA256 05740e397d579de61ff678a16a5be6ec7a15d6857d62c443f446dcf73366d1f9
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qcmdm.inf
                    • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcmdm.inf
                    • Size 67KB
                    • SHA256 2282e75ea1801093e718d01d3f3d8809dab05593bc1a6528453d3e9e981a5486
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qcser.inf
                    • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcser.inf
                    • Size 191KB
                    • SHA256 6c00625f563ebf250f875a2ed61e599aa08602e2e9f72e53d6570169b4547568
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qcwwan.inf
                    • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qcwwan.inf
                    • Size 113KB
                    • SHA256 a3e18a24716acfb38c6c92a891c4999dafc95bcb3798b6367b2a054ae3c83596
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qdbusb.inf
                    • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\fre\Windows10\qdbusb.inf
                    • Size 31KB
                    • SHA256 7f3b800bb0a6a31d07fda876961d06c2836228092b9e8402b9ba2c1e1a047f3e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qdclr64.exe
                    • Path C:\Program Files (x86)\QUALCOMM Incorporated\Qualcomm USB Drivers For Windows\DriverPackage\Qualcomm\qdclr64.exe
                    • Size 128KB
                    • SHA256 3ebcbbde1fce92b85c67b82d5884287faf6c33c57c8299ba414547ac6d82ecf4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    OSE.EXE
                    • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                    • Size 805KB
                    • SHA256 0cf121fee65eff5fd40af92b235b579e794bf62c2ec2ce3a5cc2328850fad637
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    elevation_service.exe
                    • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
                    • Size 2.8MB
                    • SHA256 9481452c2128ba7ab9fb45db221ef7b0b141bc5fa2b4a5cd72283641f4e3981a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Windows.db
                    • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db
                    • Size 972KB
                    • SHA256 8e36d2b8da98fe137ac0e48e0ce58e06c373b21bb3851ea851d1d620ed82bf63
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    Windows.db-wal
                    • Path C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.db-wal
                    • Size 1.4MB
                    • SHA256 41a581376597d2c476f4d3386cf4b2e4ef158416bc0bdab2bc8e870b6cd4ab8d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MSIB2DB.tmp
                    • Path C:\Users\Admin\AppData\Local\Temp\MSIB2DB.tmp
                    • Size 1.3MB
                    • SHA256 6b7dee440fbcde1b0a2a98d4b406b941c97154204fa0e7c79c250e01eec24c2f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    QualcommWindowsDriverInstaller.msi
                    • Path C:\Users\Admin\AppData\Local\Temp\QualcommWindowsDriverInstaller.msi
                    • Size 19.0MB
                    • SHA256 3a39d500f83754feaba714fb967231b40223a7cf94af3e30f71c01f329e0e33d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ISBEW64.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe
                    • Size 146KB
                    • SHA256 9acc6cb5d01a4e4dbc92c8774c6999fab5f0e49f097e83098ba740842f5a2894
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ISBEW64.exe
                    • Path C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISBEW64.exe
                    • Size 708KB
                    • SHA256 2e74c4d32cfe40f4da06077a7bd3fd5e0468d47d8197fe0115cfe7030945c101
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ISRT.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\ISRT.dll
                    • Size 260KB
                    • SHA256 e91a865c3d60d9d0bce5d5a0a2f551c5e032d5bc13bc40f85091ce46d38064e0
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _isres_0x0409.dll
                    • Path C:\Users\Admin\AppData\Local\Temp\{4C80A2D1-6C1F-42A4-BECD-EE905F8B4326}\_isres_0x0409.dll
                    • Size 540KB
                    • SHA256 6366e18a8cbf609c9573f341004e5c2725c23a12973affa90ee7bcc7934ae1b2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    MSI77B3.tmp
                    • Path C:\Windows\Installer\MSI77B3.tmp
                    • Size 1.9MB
                    • SHA256 19cdeee571a547c206e9ac08698194becd9afc767083708e36e752a6232bc2ea
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    perfhost.exe
                    • Path C:\Windows\SysWOW64\perfhost.exe
                    • Size 588KB
                    • SHA256 8ebc503c63def706dd88ea979ab8e8a3a808fe7fc6fd628268fff46320ead941
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    AgentService.exe
                    • Path C:\Windows\System32\AgentService.exe
                    • Size 1.4MB
                    • SHA256 5355cf6dd2db85a3025cb472765308d9a2a642c9e186b4661ffbad8150f3c64c
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    dberr.txt
                    • Path C:\Windows\System32\CatRoot2\dberr.txt
                    • Size 65KB
                    • SHA256 2055124a6d8d6c5dd622cd5c901d2bd6b41f5eb9bc0c27db0de961a17ed8f0da
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    dberr.txt
                    • Path C:\Windows\System32\CatRoot2\dberr.txt
                    • Size 65KB
                    • SHA256 520a86111dc8ec5f2f9d47adf609b544a1d0efdbb829640ca0579e9e9dea19df
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    dberr.txt
                    • Path C:\Windows\System32\CatRoot2\dberr.txt
                    • Size 65KB
                    • SHA256 608682b0b0fbdada5a6ddff854ef29e53efaeac5c10e333caeb1927dcc78f371
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    qcfilter.inf_amd64_e7cad348cef9500f.ini
                    • Path C:\Windows\System32\DriverStore\FileRepository\qcfilter.inf_amd64_e7cad348cef9500f.ini
                    • Size 439B
                    • SHA256 714b01fc82a2fb01cbc51a4667ed57d87f8ccfd8e0b14415b47b4ae0063707f3
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    qcmdm.inf_amd64_b81e7f4ee82dce31.ini
                    • Path C:\Windows\System32\DriverStore\FileRepository\qcmdm.inf_amd64_b81e7f4ee82dce31.ini
                    • Size 427B
                    • SHA256 9f128a2696221b0fa9850be0ff14d3b5fe8f0d95b0afedab7dec4f0f2c0194ab
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    qcser.inf_amd64_d9159d204b993759.ini
                    • Path C:\Windows\System32\DriverStore\FileRepository\qcser.inf_amd64_d9159d204b993759.ini
                    • Size 428B
                    • SHA256 95e4a1462cf9c23ad7dfef28e7b5e6a2b656d071e49013c87b037865cc2ea439
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    qcwwan.inf_amd64_b5e71376fe6188af.ini
                    • Path C:\Windows\System32\DriverStore\FileRepository\qcwwan.inf_amd64_b5e71376fe6188af.ini
                    • Size 433B
                    • SHA256 50267fbc43742dd6b66c607c755cf8a9ed51ef9e359eeb5824d4907296eaa06e
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    qdbusb.inf_amd64_bb9f95834d630507.ini
                    • Path C:\Windows\System32\DriverStore\FileRepository\qdbusb.inf_amd64_bb9f95834d630507.ini
                    • Size 425B
                    • SHA256 b763ce56cbd9ed83f978eadd7e88fe9b1da68643814c0d3e59b928ba09e259fa
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    ssh-agent.exe
                    • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
                    • Size 1.1MB
                    • SHA256 b6dfd5762dbc624935872083f4ffad693fc5d3ba569c5ccae008a1baad432a68
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    PerceptionSimulationService.exe
                    • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
                    • Size 804KB
                    • SHA256 56563ba5cdbce645931215d93d9070e3793c0db7cb4c25c646f467678eccea8b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    ReFsDedupSvc.exe
                    • Path C:\Windows\System32\ReFsDedupSvc.exe
                    • Size 2.6MB
                    • SHA256 920eb8548d9042a7e1978669209b4afeacde8f499071a234cef5060ad7c85bef
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SearchIndexer.exe
                    • Path C:\Windows\System32\SearchIndexer.exe
                    • Size 1.4MB
                    • SHA256 ec33b2eab48eca11055a3fa245c1338f445f583712be3ef512a35e76e707a872
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SensorDataService.exe
                    • Path C:\Windows\System32\SensorDataService.exe
                    • Size 1.7MB
                    • SHA256 d1340c2b78a523590bb7556738d4af803a6eda74a0502d2cbc3990b5cdc824c4
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    VSSVC.exe
                    • Path C:\Windows\System32\VSSVC.exe
                    • Size 1.4MB
                    • SHA256 ca3f42b78aa915f7164964871f514b42b7a4dd01fe2bf92d6458e5549a5de4e6
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    dberr.txt
                    • Path C:\Windows\System32\catroot2\dberr.txt
                    • Size 65KB
                    • SHA256 1a98f8b6c1f0341e0754e6a8a1d4d3b444d1660d095d4d26d5c4e9bdf023226f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    metadata-2
                    • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
                    • Size 26.1MB
                    • SHA256 82c473b6a00384d3a4c35ee06470281fa7af650c120f760d5a529c68ba8a5e7a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    {3fa6e550-7d6c-4756-9c2a-93e34fa9f298}_OnDiskSnapshotProp
                    • Path \??\Volume{c61f8367-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{3fa6e550-7d6c-4756-9c2a-93e34fa9f298}_OnDiskSnapshotProp
                    • Size 6KB
                    • SHA256 70084b049681ab0c6ee305dcd0000340aad0d63e65399b5211ae32f7281e75ef
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/296-38-0x0000000002360000-0x00000000023C0000-memory.dmp
                    Download

                    memory/296-50-0x0000000140000000-0x00000001400D5000-memory.dmp
                    Download

                    memory/296-44-0x0000000002360000-0x00000000023C0000-memory.dmp
                    Download

                    memory/296-37-0x0000000140000000-0x00000001400D5000-memory.dmp
                    Download

                    memory/296-48-0x0000000002360000-0x00000000023C0000-memory.dmp
                    Download

                    memory/612-54-0x0000000000890000-0x00000000008F0000-memory.dmp
                    Download

                    memory/612-60-0x0000000000890000-0x00000000008F0000-memory.dmp
                    Download

                    memory/612-53-0x0000000140000000-0x00000001400CF000-memory.dmp
                    Download

                    memory/612-277-0x0000000140000000-0x00000001400CF000-memory.dmp
                    Download

                    memory/824-307-0x0000000010000000-0x00000000101B5000-memory.dmp
                    Download

                    memory/824-344-0x0000000002C40000-0x0000000002CC9000-memory.dmp
                    Download

                    memory/824-338-0x0000000002AF0000-0x0000000002B97000-memory.dmp
                    Download

                    memory/1184-76-0x0000000000400000-0x0000000000497000-memory.dmp
                    Download

                    memory/1184-82-0x00000000008C0000-0x0000000000926000-memory.dmp
                    Download

                    memory/1184-299-0x0000000000400000-0x0000000000497000-memory.dmp
                    Download

                    memory/1184-77-0x00000000008C0000-0x0000000000926000-memory.dmp
                    Download

                    memory/2400-322-0x0000000140000000-0x00000001402C9000-memory.dmp
                    Download

                    memory/2400-86-0x0000000000750000-0x00000000007B0000-memory.dmp
                    Download

                    memory/2400-95-0x0000000140000000-0x00000001402C9000-memory.dmp
                    Download

                    memory/2400-387-0x0000000140000000-0x00000001402C9000-memory.dmp
                    Download

                    memory/2400-385-0x0000000000750000-0x00000000007B0000-memory.dmp
                    Download

                    memory/2400-92-0x0000000000750000-0x00000000007B0000-memory.dmp
                    Download

                    memory/2460-358-0x0000000140000000-0x00000001400B6000-memory.dmp
                    Download

                    memory/2752-360-0x0000000140000000-0x00000001400B6000-memory.dmp
                    Download

                    memory/2848-371-0x0000000140000000-0x00000001400B6000-memory.dmp
                    Download

                    memory/2848-349-0x0000000140000000-0x00000001400B6000-memory.dmp
                    Download

                    memory/2940-506-0x0000028282E20000-0x00000282837C4000-memory.dmp
                    Download

                    memory/2956-136-0x0000000140000000-0x0000000140168000-memory.dmp
                    Download

                    memory/2956-134-0x0000000000750000-0x00000000007B0000-memory.dmp
                    Download

                    memory/2956-132-0x0000000000750000-0x00000000007B0000-memory.dmp
                    Download

                    memory/2956-125-0x0000000140000000-0x0000000140168000-memory.dmp
                    Download

                    memory/3332-356-0x0000000140000000-0x00000001400B6000-memory.dmp
                    Download

                    memory/3384-164-0x0000000140000000-0x00000001402D4000-memory.dmp
                    Download

                    memory/3384-26-0x0000000140000000-0x00000001402D4000-memory.dmp
                    Download

                    memory/3384-33-0x00000000006E0000-0x0000000000740000-memory.dmp
                    Download

                    memory/3384-27-0x00000000006E0000-0x0000000000740000-memory.dmp
                    Download

                    memory/3404-112-0x0000000140000000-0x000000014013E000-memory.dmp
                    Download

                    memory/3404-120-0x0000000000D10000-0x0000000000D70000-memory.dmp
                    Download

                    memory/3404-339-0x0000000140000000-0x000000014013E000-memory.dmp
                    Download

                    memory/3404-114-0x0000000000D10000-0x0000000000D70000-memory.dmp
                    Download

                    memory/3540-383-0x0000025A77410000-0x0000025A774BA000-memory.dmp
                    Download

                    memory/4072-609-0x0000000000400000-0x0000000000771000-memory.dmp
                    Download

                    memory/4072-595-0x0000000001170000-0x00000000011D6000-memory.dmp
                    Download

                    memory/4072-600-0x0000000001170000-0x00000000011D6000-memory.dmp
                    Download

                    memory/4072-594-0x0000000000400000-0x0000000000771000-memory.dmp
                    Download

                    memory/4244-20-0x00000000008A0000-0x0000000000900000-memory.dmp
                    Download

                    memory/4244-21-0x00000000008A0000-0x0000000000900000-memory.dmp
                    Download

                    memory/4244-111-0x0000000140000000-0x00000001402E9000-memory.dmp
                    Download

                    memory/4244-19-0x0000000140000000-0x00000001402E9000-memory.dmp
                    Download

                    memory/4244-13-0x00000000008A0000-0x0000000000900000-memory.dmp
                    Download

                    memory/4428-363-0x0000000140000000-0x00000001400B6000-memory.dmp
                    Download

                    memory/4568-66-0x0000000000C80000-0x0000000000CE0000-memory.dmp
                    Download

                    memory/4568-295-0x0000000140000000-0x00000001400CB000-memory.dmp
                    Download

                    memory/4568-64-0x0000000140000000-0x00000001400CB000-memory.dmp
                    Download

                    memory/4568-72-0x0000000000C80000-0x0000000000CE0000-memory.dmp
                    Download

                    memory/4816-106-0x00000000006A0000-0x0000000000700000-memory.dmp
                    Download

                    memory/4816-100-0x00000000006A0000-0x0000000000700000-memory.dmp
                    Download

                    memory/4816-372-0x0000000140000000-0x00000001401BA000-memory.dmp
                    Download

                    memory/4816-99-0x0000000140000000-0x00000001401BA000-memory.dmp
                    Download

                    memory/4816-336-0x0000000140000000-0x00000001401BA000-memory.dmp
                    Download

                    memory/4816-369-0x00000000006A0000-0x0000000000700000-memory.dmp
                    Download

                    memory/4964-141-0x0000000140000000-0x0000000140172000-memory.dmp
                    Download

                    memory/4964-352-0x0000000140000000-0x0000000140172000-memory.dmp
                    Download

                    memory/4964-142-0x0000000000620000-0x0000000000680000-memory.dmp
                    Download

                    memory/4964-148-0x0000000000620000-0x0000000000680000-memory.dmp
                    Download

                    memory/5696-0-0x00000000036E0000-0x0000000003746000-memory.dmp
                    Download

                    memory/5696-94-0x0000000000400000-0x000000000195C000-memory.dmp
                    Download

                    memory/5696-604-0x0000000000400000-0x000000000195C000-memory.dmp
                    Download

                    memory/5696-8-0x0000000000400000-0x000000000195C000-memory.dmp
                    Download

                    memory/5696-6-0x00000000036E0000-0x0000000003746000-memory.dmp
                    Download

                    memory/6000-354-0x0000000140000000-0x00000001400B6000-memory.dmp
                    Download