Overview

overview

8

Static

static

1

Gear Link_....5.zip

windows10-2004-x64

1

Gear Link_....5.zip

windows11-ltsc_2024-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    599s
  • max time network
    478s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/08/2026, 22:54

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Gear Link_Utility Companion_2.0.0.5.zip
  • Size 59.4MB
  • Sample260822-2vm6escn6s
  • SHA256 42f8675be002aff80197dc4668a7f524b1783eac837b480fca31a9fc4b1bcdc1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoveryexecutionpersistenceprivilege_escalationransomware

Malware Config

Signatures

  • Modifies Windows Firewall 2 TTPs 3 IoCs
    defense_evasion
  • Executes dropped EXE 23 IoCs
  • Loads dropped DLL 28 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 42 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Executes a command shell one-liner 1 TTPs 12 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 39 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies registry class 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 29 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 5 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,"C:\Users\Admin\AppData\Local\Temp\Gear Link_Utility Companion_2.0.0.5.zip"
    1⤵
      PID:3680
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:3468
      • C:\Program Files\7-Zip\7zG.exe
        "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap4622:128:7zEvent21166
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2576
      • C:\Users\Admin\Desktop\Gear Link_Utility Companion_2.0.0.5\setup.exe
        "C:\Users\Admin\Desktop\Gear Link_Utility Companion_2.0.0.5\setup.exe"
        1⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4812
        • C:\Users\Admin\AppData\Local\Temp\{FCDD0E42-0B0F-46DE-A0F5-0E4460495A6D}\setup.exe
          C:\Users\Admin\AppData\Local\Temp\{FCDD0E42-0B0F-46DE-A0F5-0E4460495A6D}\setup.exe -no_selfdeleter -IS_temp -media_path:"C:\Users\Admin\Desktop\Gear Link_Utility Companion_2.0.0.5\" -tempdisk1folder:"C:\Users\Admin\AppData\Local\Temp\{FCDD0E42-0B0F-46DE-A0F5-0E4460495A6D}\" -IS_OriginalLauncher:"C:\Users\Admin\Desktop\Gear Link_Utility Companion_2.0.0.5\setup.exe" -waitingforchildprocess
          2⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Drops file in Program Files directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of WriteProcessMemory
          PID:2660
          • C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{31272279-BF7A-4251-A269-E7E9D5C4EFF0}
            3⤵
            • Executes dropped EXE
            PID:4120
          • C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F73BFE1B-055F-453B-BDDA-84020120AB4C}
            3⤵
            • Executes dropped EXE
            PID:3008
          • C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{EA30E9BC-E4D4-4751-A333-4146B1E7A4D5}
            3⤵
            • Executes dropped EXE
            PID:3944
          • C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6D32521C-AD46-4072-8566-5D623D8AC4AA}
            3⤵
            • Executes dropped EXE
            PID:1476
          • C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{5BDF3E49-DF2A-42AB-A850-17089D10B148}
            3⤵
            • Executes dropped EXE
            PID:464
          • C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\ISBEW64.exe
            C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D4340E62-D302-4EB9-9AA0-A0C01D5E3B47}
            3⤵
            • Executes dropped EXE
            PID:1216
          • C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\InstallTools\InstallTmp\windowsdesktop-runtime-8.0.14-win-x64.exe
            "C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\InstallTools\InstallTmp\windowsdesktop-runtime-8.0.14-win-x64.exe" -s
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4964
            • C:\Windows\Temp\{38B08A9B-62D0-448A-A4C2-09158E39E734}\.cr\windowsdesktop-runtime-8.0.14-win-x64.exe
              "C:\Windows\Temp\{38B08A9B-62D0-448A-A4C2-09158E39E734}\.cr\windowsdesktop-runtime-8.0.14-win-x64.exe" -burn.clean.room="C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\InstallTools\InstallTmp\windowsdesktop-runtime-8.0.14-win-x64.exe" -burn.filehandle.attached=732 -burn.filehandle.self=736 -s
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5332
              • C:\Windows\Temp\{C8695AAB-0732-4D7F-B610-3C3428E5DC9D}\.be\windowsdesktop-runtime-8.0.14-win-x64.exe
                "C:\Windows\Temp\{C8695AAB-0732-4D7F-B610-3C3428E5DC9D}\.be\windowsdesktop-runtime-8.0.14-win-x64.exe" -q -burn.elevated BurnPipe.{311A11AF-BB2F-4226-BDEB-405BF75CAB9D} {2B9B8488-F5E0-4CDD-A074-D1F8FCEE93EE} 5332
                5⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of AdjustPrivilegeToken
                PID:5484
          • C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\InstallTools\Launcher.exe
            "C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\InstallTools\Launcher.exe" -a
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:2028
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c netsh advfirewall firewall add rule name="GearLink_MacroServer" dir=in action=allow program="C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_MacroServer.exe" enable=yes
              4⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2704
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="GearLink_MacroServer" dir=in action=allow program="C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_MacroServer.exe" enable=yes
                5⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:2640
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c netsh advfirewall firewall add rule name="GearLink_UtilityCompanion" dir=in action=allow program="C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_UtilityCompanion.exe" enable=yes
              4⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4196
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="GearLink_UtilityCompanion" dir=in action=allow program="C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_UtilityCompanion.exe" enable=yes
                5⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:5500
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c netsh advfirewall firewall add rule name="GearLink_PowerNotification" dir=in action=allow program="C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_PowerNotification.exe" enable=yes
              4⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4636
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="GearLink_PowerNotification" dir=in action=allow program="C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_PowerNotification.exe" enable=yes
                5⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                • System Location Discovery: System Language Discovery
                PID:4856
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c schtasks /query /tn "ASUS\GearLink_MacroServerTask"
              4⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1260
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /query /tn "ASUS\GearLink_MacroServerTask"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2396
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c schtasks /create /tn "ASUS\GearLink_MacroServerTask" /tr "\"C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_MacroServer.exe\"" /sc onlogon
              4⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:956
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "ASUS\GearLink_MacroServerTask" /tr "\"C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_MacroServer.exe\"" /sc onlogon
                5⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:3644
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c powershell -Command "$t = Get-ScheduledTask -TaskName 'GearLink_MacroServerTask' -TaskPath '\ASUS\'; $t.Settings.DisallowStartIfOnBatteries = $false; $t.Settings.StopIfGoingOnBatteries = $false; $t.Settings.ExecutionTimeLimit = 'PT0S'; $t.Settings.StartWhenAvailable = $true; Set-ScheduledTask -TaskName 'GearLink_MacroServerTask' -TaskPath '\ASUS\' -Settings $t.Settings"
              4⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3020
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command "$t = Get-ScheduledTask -TaskName 'GearLink_MacroServerTask' -TaskPath '\ASUS\'; $t.Settings.DisallowStartIfOnBatteries = $false; $t.Settings.StopIfGoingOnBatteries = $false; $t.Settings.ExecutionTimeLimit = 'PT0S'; $t.Settings.StartWhenAvailable = $true; Set-ScheduledTask -TaskName 'GearLink_MacroServerTask' -TaskPath '\ASUS\' -Settings $t.Settings"
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:2992
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c schtasks /query /tn "ASUS\GearLink_UtilityCompanionTask"
              4⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4892
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /query /tn "ASUS\GearLink_UtilityCompanionTask"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:2580
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c schtasks /create /tn "ASUS\GearLink_UtilityCompanionTask" /tr "\"C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_UtilityCompanion.exe\"" /sc onlogon
              4⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4932
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "ASUS\GearLink_UtilityCompanionTask" /tr "\"C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_UtilityCompanion.exe\"" /sc onlogon
                5⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:5384
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c powershell -Command "$t = Get-ScheduledTask -TaskName 'GearLink_UtilityCompanionTask' -TaskPath '\ASUS\'; $t.Settings.DisallowStartIfOnBatteries = $false; $t.Settings.StopIfGoingOnBatteries = $false; $t.Settings.ExecutionTimeLimit = 'PT0S'; $t.Settings.StartWhenAvailable = $true; Set-ScheduledTask -TaskName 'GearLink_UtilityCompanionTask' -TaskPath '\ASUS\' -Settings $t.Settings"
              4⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4680
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command "$t = Get-ScheduledTask -TaskName 'GearLink_UtilityCompanionTask' -TaskPath '\ASUS\'; $t.Settings.DisallowStartIfOnBatteries = $false; $t.Settings.StopIfGoingOnBatteries = $false; $t.Settings.ExecutionTimeLimit = 'PT0S'; $t.Settings.StartWhenAvailable = $true; Set-ScheduledTask -TaskName 'GearLink_UtilityCompanionTask' -TaskPath '\ASUS\' -Settings $t.Settings"
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:5448
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c schtasks /query /tn "ASUS\GearLink_PowerNotificationTask"
              4⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5632
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /query /tn "ASUS\GearLink_PowerNotificationTask"
                5⤵
                • System Location Discovery: System Language Discovery
                PID:1520
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c schtasks /create /tn "ASUS\GearLink_PowerNotificationTask" /tr "\"C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_PowerNotification.exe\"" /sc onlogon
              4⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:3092
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /create /tn "ASUS\GearLink_PowerNotificationTask" /tr "\"C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_PowerNotification.exe\"" /sc onlogon
                5⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:2384
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /c powershell -Command "$t = Get-ScheduledTask -TaskName 'GearLink_PowerNotificationTask' -TaskPath '\ASUS\'; $t.Settings.DisallowStartIfOnBatteries = $false; $t.Settings.StopIfGoingOnBatteries = $false; $t.Settings.ExecutionTimeLimit = 'PT0S'; $t.Settings.StartWhenAvailable = $true; Set-ScheduledTask -TaskName 'GearLink_PowerNotificationTask' -TaskPath '\ASUS\' -Settings $t.Settings"
              4⤵
              • Executes a command shell one-liner
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:5424
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                powershell -Command "$t = Get-ScheduledTask -TaskName 'GearLink_PowerNotificationTask' -TaskPath '\ASUS\'; $t.Settings.DisallowStartIfOnBatteries = $false; $t.Settings.StopIfGoingOnBatteries = $false; $t.Settings.ExecutionTimeLimit = 'PT0S'; $t.Settings.StartWhenAvailable = $true; Set-ScheduledTask -TaskName 'GearLink_PowerNotificationTask' -TaskPath '\ASUS\' -Settings $t.Settings"
                5⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                PID:4372
            • C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_MacroServer.exe
              "C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_MacroServer.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:5376
            • C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_UtilityCompanion.exe
              "C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_UtilityCompanion.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:6096
            • C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_PowerNotification.exe
              "C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_PowerNotification.exe"
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1156
          • C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\InstallTools\Launcher.exe
            "C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\InstallTools\Launcher.exe" -rs
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            PID:3360
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:3040
      • C:\Windows\system32\srtasks.exe
        C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
        1⤵
          PID:4688
        • C:\Windows\system32\msiexec.exe
          C:\Windows\system32\msiexec.exe /V
          1⤵
          • Enumerates connected drives
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2772
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 2168C0F9DBE1E1C2065514B5714AEFE7
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:5360
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 6D8452467799AD88B654D012B33CB1F1
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:4376
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding 6F9791855111E15E6B6C1F327A76FE2D
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:2044
          • C:\Windows\syswow64\MsiExec.exe
            C:\Windows\syswow64\MsiExec.exe -Embedding C796658F4716DED55EEB7EFD9106B120
            2⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            PID:1928
        • C:\ProgramData\Package Cache\{f4c6fb4c-68da-475b-8e92-fd8e6f8960cd}\windowsdesktop-runtime-8.0.14-win-x64.exe
          "C:\ProgramData\Package Cache\{f4c6fb4c-68da-475b-8e92-fd8e6f8960cd}\windowsdesktop-runtime-8.0.14-win-x64.exe" /burn.runonce
          1⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:5444
          • C:\ProgramData\Package Cache\{f4c6fb4c-68da-475b-8e92-fd8e6f8960cd}\windowsdesktop-runtime-8.0.14-win-x64.exe
            "C:\ProgramData\Package Cache\{f4c6fb4c-68da-475b-8e92-fd8e6f8960cd}\windowsdesktop-runtime-8.0.14-win-x64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.14_(x64)_20260822235851.log"
            2⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2144
            • C:\ProgramData\Package Cache\{f4c6fb4c-68da-475b-8e92-fd8e6f8960cd}\windowsdesktop-runtime-8.0.14-win-x64.exe
              "C:\ProgramData\Package Cache\{f4c6fb4c-68da-475b-8e92-fd8e6f8960cd}\windowsdesktop-runtime-8.0.14-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{f4c6fb4c-68da-475b-8e92-fd8e6f8960cd}\windowsdesktop-runtime-8.0.14-win-x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.14_(x64)_20260822235851.log"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:6068
              • C:\ProgramData\Package Cache\{f4c6fb4c-68da-475b-8e92-fd8e6f8960cd}\windowsdesktop-runtime-8.0.14-win-x64.exe
                "C:\ProgramData\Package Cache\{f4c6fb4c-68da-475b-8e92-fd8e6f8960cd}\windowsdesktop-runtime-8.0.14-win-x64.exe" -q -burn.elevated BurnPipe.{F0BBBA7A-E0B4-4CA2-BF5A-9E88033D0F5F} {772651C1-ADA9-4D49-A967-1CD6E65E56A6} 6068
                4⤵
                • Executes dropped EXE
                • Adds Run key to start application
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                PID:1428
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:1280
          • C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_MacroServer.exe
            "C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_MacroServer.exe"
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:3144
          • C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_UtilityCompanion.exe
            "C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_UtilityCompanion.exe"
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:2044
          • C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_PowerNotification.exe
            "C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\GearLink_PowerNotification.exe"
            1⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:4128

          Network

                MITRE ATT&CK Enterprise v16

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                2
                T1059

                PowerShell

                1
                T1059.001

                Windows Command Shell

                1
                T1059.003

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Create or Modify System Process

                1
                T1543

                Windows Service

                1
                T1543.003

                Event Triggered Execution

                1
                T1546

                Netsh Helper DLL

                1
                T1546.007

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Impair Defenses

                1
                T1562

                Disable or Modify System Firewall

                1
                T1562.004

                Modify Registry

                1
                T1112

                Credential Access

                Discovery

                Peripheral Device Discovery

                2
                T1120

                Query Registry

                3
                T1012

                System Information Discovery

                3
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                Lateral Movement

                Collection

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                e5a99b4.rbs
                • Path C:\Config.Msi\e5a99b4.rbs
                • Size 48KB
                • SHA256 7b4f66c5a1f7c09d0308a280cd8ecc2608134728e13730d7a51f381d8bfb59b1
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                e5a99b9.rbs
                • Path C:\Config.Msi\e5a99b9.rbs
                • Size 9KB
                • SHA256 89cb5e37033afab455a7d9feae3e1dca50bc4bff7f150d9d2f70aa3f65e88957
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                e5a99be.rbs
                • Path C:\Config.Msi\e5a99be.rbs
                • Size 87KB
                • SHA256 f9064e749f477d4f7461b8df09a9eed9f93eef2c01f7f5f62b764a843b38400b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                e5a99c2.rbs
                • Path C:\Config.Msi\e5a99c2.rbs
                • Size 3KB
                • SHA256 156fd74494a5532bb9c3ac5f51eb62e3c7a6551053b1e75ec618ccd113e18b27
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Gea8B19.tmp
                • Path C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\Gea8B19.tmp
                • Size 515B
                • SHA256 89ad1ea5c9c20b6b266547ef27c0ae3840cab5642d3c2aedf06b7026245671dd
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Launcher.exe
                • Path C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\InstallTools\Launcher.exe
                • Size 304KB
                • SHA256 1d8d7adf2ef78cd49916df13b4ac3fbe20f15735c01136285e0b77c46955f69a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                vcruntime140.dll
                • Path C:\Program Files (x86)\ASUS\Gear Link\GearLink_UtilityCompanion\InstallTools\vcruntime140.dll
                • Size 88KB
                • SHA256 09d1e604e8cdd06176fcc3d3698861be20638a4391f9f2d9e23f868c1576ca94
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                set8AE4.tmp
                • Path C:\Program Files (x86)\InstallShield Installation Information\{B4E6DB7B-B76F-4369-97F5-6A0FF5BBDC2E}\set8AE4.tmp
                • Size 2KB
                • SHA256 d9e8751c81b9d05752040a6de038fa7ea92889a9bf07a80c739c66834b890328
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                state.rsm
                • Path C:\ProgramData\Package Cache\{f4c6fb4c-68da-475b-8e92-fd8e6f8960cd}\state.rsm
                • Size 1KB
                • SHA256 7f96babd118b9fa9aa8becf59c9f089ce8bb0c76fbf532c080facf7561549bce
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                GearLink_UtilityCompanion.txt
                • Path C:\Users\Admin\AppData\Local\ASUS\Gear Link\InstallLog\GearLink_UtilityCompanion.txt
                • Size 1KB
                • SHA256 ec6a9a4ab3b7ecd6497a815cfce1c43d5bc7b4e99ad09411fbeb7cccd4c772ad
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                GearLink_UtilityCompanion.txt
                • Path C:\Users\Admin\AppData\Local\ASUS\Gear Link\InstallLog\GearLink_UtilityCompanion.txt
                • Size 2KB
                • SHA256 4c85575bc47b3d33509bf414bdc4dd121121cad39884c311afd9664c87cc02c8
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                GearLink_UtilityCompanion.txt
                • Path C:\Users\Admin\AppData\Local\ASUS\Gear Link\InstallLog\GearLink_UtilityCompanion.txt
                • Size 1KB
                • SHA256 fb4770eb4a368ffa5a739f9d4911e1ea4eb84adf78942b8a1c2ff56fe7519d21
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Microsoft_Windows_Desktop_Runtime_-_8.0.14_(x64)_20260822235851_000_dotnet_runtime_8.0.14_win_x64.msi.log
                • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.14_(x64)_20260822235851_000_dotnet_runtime_8.0.14_win_x64.msi.log
                • Size 4KB
                • SHA256 837ce2b31f98732cf412e75a3574d4d583e28b5315ac85fbe63deb97e2543b5b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Microsoft_Windows_Desktop_Runtime_-_8.0.14_(x64)_20260822235851_001_dotnet_hostfxr_8.0.14_win_x64.msi.log
                • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.14_(x64)_20260822235851_001_dotnet_hostfxr_8.0.14_win_x64.msi.log
                • Size 2KB
                • SHA256 156c12f2d82194ecc786b62b5049da99090f6117e4cd7f3e0493303d938a4a98
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                Microsoft_Windows_Desktop_Runtime_-_8.0.14_(x64)_20260822235851_002_windowsdesktop_runtime_8.0.14_win_x64.msi.log
                • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.14_(x64)_20260822235851_002_windowsdesktop_runtime_8.0.14_win_x64.msi.log
                • Size 2KB
                • SHA256 de893a71b8af784d455ea7350b5d6fe0d21bf084881a39c9bb4e8ec2a5af689e
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                __PSScriptPolicyTest_3lwc5mxy.hsk.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3lwc5mxy.hsk.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                ISBEW64.exe
                • Path C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\ISBEW64.exe
                • Size 219KB
                • SHA256 7ca89c32e819de7595f4b1e7fe855aa5ee5722c4b7a585f20abdba05356dae10
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                Config.ini
                • Path C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\{B4E6DB7B-B76F-4369-97F5-6A0FF5BBDC2E}\Config.ini
                • Size 901B
                • SHA256 c6e5299c61efa1c108ef4ac2ca87c2d330fd0dd9621c2b6c9d93258c5cfee201
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                DIFxData.ini
                • Path C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\{B4E6DB7B-B76F-4369-97F5-6A0FF5BBDC2E}\DIFxData.ini
                • Size 84B
                • SHA256 6bc8b890884278599e4c0ca4095cefdf0f5394c5796012d169cc0933e03267a1
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                FontData.ini
                • Path C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\{B4E6DB7B-B76F-4369-97F5-6A0FF5BBDC2E}\FontData.ini
                • Size 37B
                • SHA256 a7e91b042ce33490353c00244c0420c383a837e73e6006837a60d3c174102932
                • MD5 SHA1 SHA512
                Submit Download

                VersionHelper.dll
                • Path C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\{B4E6DB7B-B76F-4369-97F5-6A0FF5BBDC2E}\VersionHelper.dll
                • Size 432KB
                • SHA256 3136db863902302f74fb62d616072d907d453227bb9ff9022424ce6310102c2b
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                _isres_0x0409.dll
                • Path C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\{B4E6DB7B-B76F-4369-97F5-6A0FF5BBDC2E}\_isres_0x0409.dll
                • Size 1.8MB
                • SHA256 ca71e3e642ec45073d723851e519df266264ebbf69b0971a490552dc4abdd5dd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                isrt.dll
                • Path C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\{B4E6DB7B-B76F-4369-97F5-6A0FF5BBDC2E}\isrt.dll
                • Size 1.1MB
                • SHA256 2bd0e8f96cd0a3fd6d5bb93bfb045f6e8e6e4705723967fa905e0c66136eabb0
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                setup.inx
                • Path C:\Users\Admin\AppData\Local\Temp\{5CF89634-CF02-484A-847B-F6661C115713}\{B4E6DB7B-B76F-4369-97F5-6A0FF5BBDC2E}\setup.inx
                • Size 229KB
                • SHA256 eabdaca0f4de9816c30985832265854998d898f26c43446649709056f99baf15
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                0x0409.ini
                • Path C:\Users\Admin\Desktop\Gear Link_Utility Companion_2.0.0.5\0x0409.ini
                • Size 22KB
                • SHA256 cdb316d7f9aa2d854eb28f7a333426a55cc65fa7d31b0bdf8ae108e611583d29
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                ISSetup.dll
                • Path C:\Users\Admin\Desktop\Gear Link_Utility Companion_2.0.0.5\ISSetup.dll
                • Size 1.7MB
                • SHA256 d2063cc059cea44f8c7a6a002fedb25590570a865de030ef1e04f4a59639d40e
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data1.cab
                • Path C:\Users\Admin\Desktop\Gear Link_Utility Companion_2.0.0.5\data1.cab
                • Size 1.3MB
                • SHA256 a89ae37afe582f6bc943f4bfe5905936c9b2b7dd26ee9cbd95aa94258eecae77
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                data1.hdr
                • Path C:\Users\Admin\Desktop\Gear Link_Utility Companion_2.0.0.5\data1.hdr
                • Size 16KB
                • SHA256 d9fa972f68429cdf3f8d9857740e4b34b6db5014f602c9a544a24031f844b35f
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                layout.bin
                • Path C:\Users\Admin\Desktop\Gear Link_Utility Companion_2.0.0.5\layout.bin
                • Size 550B
                • SHA256 f91f28c670eddf86d4bec59faf079a65674642c605c044823599d728a2cf6953
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                setup.exe
                • Path C:\Users\Admin\Desktop\Gear Link_Utility Companion_2.0.0.5\setup.exe
                • Size 1.0MB
                • SHA256 feb8871054dc21d9bee9d9b52343e62e72d1a4f91b949f578eb8a071dba6c2fd
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                setup.ini
                • Path C:\Users\Admin\Desktop\Gear Link_Utility Companion_2.0.0.5\setup.ini
                • Size 2KB
                • SHA256 55c38aaf41f4c048720ad3c01b36d6bedb4fd23fb7f85e22e2eae1c5a08ab990
                • MD5 SHA1 SHA512 TLSH
                Submit Download

                MSIA73E.tmp
                • Path C:\Windows\Installer\MSIA73E.tmp
                • Size 219KB
                • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                windowsdesktop-runtime-8.0.14-win-x64.exe
                • Path C:\Windows\Temp\{38B08A9B-62D0-448A-A4C2-09158E39E734}\.cr\windowsdesktop-runtime-8.0.14-win-x64.exe
                • Size 608KB
                • SHA256 f5134a1880a8201131b265ae6763301aad009f6ed641298f23af9f5f73b6f8e7
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                bg.png
                • Path C:\Windows\Temp\{C8695AAB-0732-4D7F-B610-3C3428E5DC9D}\.ba\bg.png
                • Size 4KB
                • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                wixstdba.dll
                • Path C:\Windows\Temp\{C8695AAB-0732-4D7F-B610-3C3428E5DC9D}\.ba\wixstdba.dll
                • Size 190KB
                • SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dotnet_hostfxr_8.0.14_win_x64.msi
                • Path C:\Windows\Temp\{C8695AAB-0732-4D7F-B610-3C3428E5DC9D}\dotnet_hostfxr_8.0.14_win_x64.msi
                • Size 772KB
                • SHA256 4b5475d850a6e2d336043747f22acd84ae6f4c300ea3bdc69cbb4c23a2d9c5d5
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                dotnet_runtime_8.0.14_win_x64.msi
                • Path C:\Windows\Temp\{C8695AAB-0732-4D7F-B610-3C3428E5DC9D}\dotnet_runtime_8.0.14_win_x64.msi
                • Size 26.2MB
                • SHA256 69a125ea1d803bd539acf6f65ef581aee1171709660398b8ef5cceeeeba198bf
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                windowsdesktop_runtime_8.0.14_win_x64.msi
                • Path C:\Windows\Temp\{C8695AAB-0732-4D7F-B610-3C3428E5DC9D}\windowsdesktop_runtime_8.0.14_win_x64.msi
                • Size 29.2MB
                • SHA256 92067e45536617975c5a5cd8ad68b4423599830387bb2d8cd47c3ecd93adb082
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                thm.wxl
                • Path C:\Windows\Temp\{E579E25F-8A59-4B05-ACF1-412DC198DA7A}\.ba\1033\thm.wxl
                • Size 5KB
                • SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
                • MD5 SHA1 SHA512 SSDEEP TLSH
                Submit Download

                memory/2660-119-0x0000000006020000-0x00000000061E7000-memory.dmp
                Download

                memory/2992-1049-0x0000000004D50000-0x0000000004D72000-memory.dmp
                Download

                memory/2992-1076-0x0000000007610000-0x0000000007C8C000-memory.dmp
                Download

                memory/2992-1051-0x00000000056F0000-0x0000000005756000-memory.dmp
                Download

                memory/2992-1054-0x00000000058B0000-0x0000000005C0B000-memory.dmp
                Download

                memory/2992-1056-0x0000000005C30000-0x0000000005C4E000-memory.dmp
                Download

                memory/2992-1048-0x0000000004FC0000-0x000000000560A000-memory.dmp
                Download

                memory/2992-1063-0x0000000005C70000-0x0000000005CBC000-memory.dmp
                Download

                memory/2992-1071-0x000000006DF40000-0x000000006DF8C000-memory.dmp
                Download

                memory/2992-1070-0x0000000006BD0000-0x0000000006C06000-memory.dmp
                Download

                memory/2992-1074-0x0000000006BB0000-0x0000000006BD0000-memory.dmp
                Download

                memory/2992-1075-0x0000000006EE0000-0x0000000006F83000-memory.dmp
                Download

                memory/2992-1050-0x0000000005680000-0x00000000056E6000-memory.dmp
                Download

                memory/2992-1077-0x0000000006F90000-0x0000000006FAA000-memory.dmp
                Download

                memory/2992-1078-0x0000000007010000-0x000000000701A000-memory.dmp
                Download

                memory/2992-1079-0x0000000007240000-0x00000000072D6000-memory.dmp
                Download

                memory/2992-1080-0x00000000071A0000-0x00000000071B1000-memory.dmp
                Download

                memory/2992-1047-0x00000000047A0000-0x00000000047D6000-memory.dmp
                Download

                memory/4372-1103-0x0000000072230000-0x000000007227C000-memory.dmp
                Download

                memory/5448-1089-0x0000000005EC0000-0x000000000621B000-memory.dmp
                Download

                memory/5448-1090-0x0000000006980000-0x00000000069CC000-memory.dmp
                Download

                memory/5448-1091-0x0000000072230000-0x000000007227C000-memory.dmp
                Download

                memory/5448-1094-0x00000000076E0000-0x0000000007783000-memory.dmp
                Download

                memory/5448-1098-0x00000000079D0000-0x00000000079E1000-memory.dmp
                Download