Overview

overview

10

Static

static

3

f711703c8b...54.exe

windows7-x64

10

f711703c8b...54.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/11/2024, 03:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    f711703c8ba66dcedb8e4b83f21a0425c528e278242c852fd5cf54bb43e30454.exe
  • Size 1.0MB
  • Sample241113-dln5csvkcy
  • SHA256 f711703c8ba66dcedb8e4b83f21a0425c528e278242c852fd5cf54bb43e30454
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
agentteslamodiloaderdiscoveryexecutionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Credentials
  • Protocol

    smtp
  • Host

    s82.gocheapweb.com
  • Port

    587
  • Username

    [email protected]
  • Password

    london@1759

Extracted

Family

  • agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Agenttesla family
    agenttesla
  • ModiLoader, DBatLoader

    ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    trojanmodiloader
  • Modiloader family
    modiloader
  • ModiLoader Second Stage 61 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 8 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 5 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f711703c8ba66dcedb8e4b83f21a0425c528e278242c852fd5cf54bb43e30454.exe
    "C:\Users\Admin\AppData\Local\Temp\f711703c8ba66dcedb8e4b83f21a0425c528e278242c852fd5cf54bb43e30454.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4432
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Libraries\lxsyrsiW.cmd" "
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4572
      • C:\Windows\SysWOW64\esentutl.exe
        C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\cmd.exe /d C:\\Users\\Public\\alpha.pif /o
        3⤵
          PID:3276
        • C:\Windows\SysWOW64\esentutl.exe
          C:\\Windows\\System32\\esentutl /y C:\\Windows\\System32\\ping.exe /d C:\\Users\\Public\\xpha.pif /o
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          PID:2868
        • C:\Users\Public\alpha.pif
          C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows "
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:4904
        • C:\Users\Public\alpha.pif
          C:\\Users\\Public\\alpha.pif /c mkdir "\\?\C:\Windows \SysWOW64"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:900
        • C:\Users\Public\alpha.pif
          C:\\Users\\Public\\alpha.pif /c C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4772
          • C:\Users\Public\xpha.pif
            C:\\Users\\Public\\xpha.pif 127.0.0.1 -n 10
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:3492
        • C:\Windows \SysWOW64\per.exe
          "C:\\Windows \\SysWOW64\\per.exe
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:992
          • C:\Windows\SYSTEM32\esentutl.exe
            esentutl /y C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe /d C:\\Users\\Public\\pha.pif /o
            4⤵
              PID:2892
            • C:\Users\Public\pha.pif
              C:\\Users\\Public\\pha.pif -WindowStyle hidden -Command Add-MpPreference -ExclusionPath 'C:\Users'
              4⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:900
          • C:\Users\Public\alpha.pif
            C:\\Users\\Public\\alpha.pif /c del "C:\Users\Public\xpha.pif"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1416
          • C:\Users\Public\alpha.pif
            C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \SysWOW64
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4464
          • C:\Users\Public\alpha.pif
            C:\\Users\\Public\\alpha.pif /c rmdir "C:\Windows \"
            3⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:4824
        • C:\Windows\SysWOW64\esentutl.exe
          C:\\Windows\\System32\\esentutl.exe /y C:\Users\Admin\AppData\Local\Temp\f711703c8ba66dcedb8e4b83f21a0425c528e278242c852fd5cf54bb43e30454.exe /d C:\\Users\\Public\\Libraries\\Wisrysxl.PIF /o
          2⤵
            PID:3924
          • C:\Users\Public\Libraries\lxsyrsiW.pif
            C:\Users\Public\Libraries\lxsyrsiW.pif
            2⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Drops file in System32 directory
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1876
            • C:\Users\Admin\AppData\Local\Temp\neworigin.exe
              "C:\Users\Admin\AppData\Local\Temp\neworigin.exe"
              3⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of SetWindowsHookEx
              PID:2356
            • C:\Users\Admin\AppData\Local\Temp\server_BTC.exe
              "C:\Users\Admin\AppData\Local\Temp\server_BTC.exe"
              3⤵
              • Checks computer location settings
              • Drops startup file
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:712
              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\ACCApi'
                4⤵
                • Command and Scripting Interpreter: PowerShell
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:4328
              • C:\Windows\SysWOW64\schtasks.exe
                "schtasks.exe" /create /tn AccSys /tr "C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe" /st 03:12 /du 23:59 /sc daily /ri 1 /f
                4⤵
                • System Location Discovery: System Language Discovery
                • Scheduled Task/Job: Scheduled Task
                PID:3492
              • C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe
                "C:\Users\Admin\AppData\Roaming\ACCApi\TrojanAIbot.exe"
                4⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: AddClipboardFormatListener
                • Suspicious use of AdjustPrivilegeToken
                PID:2828
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpA92C.tmp.cmd""
                4⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3848
                • C:\Windows\SysWOW64\timeout.exe
                  timeout 6
                  5⤵
                  • System Location Discovery: System Language Discovery
                  • Delays execution with timeout.exe
                  PID:2188
        • C:\Windows\System32\alg.exe
          C:\Windows\System32\alg.exe
          1⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Drops file in Windows directory
          • Suspicious use of AdjustPrivilegeToken
          PID:4556
        • C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
          C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
          1⤵
          • Executes dropped EXE
          PID:552
        • C:\Windows\System32\svchost.exe
          C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
          1⤵
            PID:1236
          • C:\Windows\system32\fxssvc.exe
            C:\Windows\system32\fxssvc.exe
            1⤵
            • Executes dropped EXE
            • Modifies data under HKEY_USERS
            • Suspicious use of AdjustPrivilegeToken
            PID:4996
          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"
            1⤵
            • Executes dropped EXE
            PID:4696
          • C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
            "C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
            1⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            PID:4260
          • \??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
            "c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
            1⤵
            • Executes dropped EXE
            PID:1380

          Network

                MITRE ATT&CK Enterprise v15

                Reconnaissance

                Resource Development

                Initial Access

                Execution

                Command and Scripting Interpreter

                1
                T1059

                PowerShell

                1
                T1059.001

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Persistence

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Privilege Escalation

                Boot or Logon Autostart Execution

                1
                T1547

                Registry Run Keys / Startup Folder

                1
                T1547.001

                Scheduled Task/Job

                1
                T1053

                Scheduled Task

                1
                T1053.005

                Defense Evasion

                Modify Registry

                1
                T1112

                Credential Access

                Credentials from Password Stores

                1
                T1555

                Credentials from Web Browsers

                1
                T1555.003

                Unsecured Credentials

                4
                T1552

                Credentials In Files

                3
                T1552.001

                Credentials in Registry

                1
                T1552.002

                Discovery

                Query Registry

                1
                T1012

                System Information Discovery

                2
                T1082

                System Location Discovery

                1
                T1614

                System Language Discovery

                1
                T1614.001

                System Network Configuration Discovery

                1
                T1016

                Internet Connection Discovery

                1
                T1016.001

                Lateral Movement

                Collection

                Data from Local System

                4
                T1005

                Command and Control

                Exfiltration

                Impact

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                elevation_service.exe
                • Path C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe
                • Size 2.1MB
                • SHA256 cbc6a367e81f8c9aa40c70de9b9f8300e91aadbf883cc8ac106629036da6bc12
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                maintenanceservice.exe
                • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
                • Size 1.3MB
                • SHA256 eed8763f0510bf655a0bf7ffe56a412cd284b673348932ad107fa8fc5b4f4e00
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                OSE.EXE
                • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
                • Size 1.3MB
                • SHA256 27f4aa6c386a50d7f4d7bfe796c55b602e80066f973e4427d285dd1a8b984e07
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                elevation_service.exe
                • Path C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                • Size 2.1MB
                • SHA256 a2f3bd966a13a53e0be11a41c8edc07ae8d620e45b031a4c988d8912be993161
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                StartupProfileData-NonInteractive
                • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                • Size 944B
                • SHA256 2360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
                • MD5 SHA1 SHA512
                Submit Download

                __PSScriptPolicyTest_3h11jglp.p4c.ps1
                • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3h11jglp.p4c.ps1
                • Size 60B
                • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                • MD5 SHA1 SHA512
                Submit Download

                neworigin.exe
                • Path C:\Users\Admin\AppData\Local\Temp\neworigin.exe
                • Size 244KB
                • SHA256 dc441006cb45c2cfac6c521f6cd4c16860615d21081563bd9e368de6f7e8ab6b
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                server_BTC.exe
                • Path C:\Users\Admin\AppData\Local\Temp\server_BTC.exe
                • Size 226KB
                • SHA256 36fe89b3218d2d0bbf865967cdc01b9004e3ba13269909e3d24d7ff209f28fc5
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                tmpA92C.tmp.cmd
                • Path C:\Users\Admin\AppData\Local\Temp\tmpA92C.tmp.cmd
                • Size 162B
                • SHA256 8bd1f0ae3dd998e73497347d4a3fe5b11b102faa8f84751f4cfe9e0635553688
                • MD5 SHA1 SHA512
                Submit Download

                lxsyrsiW.cmd
                • Path C:\Users\Public\Libraries\lxsyrsiW.cmd
                • Size 60KB
                • SHA256 d08ccc9b1e3acc205fe754bad8416964e9711815e9ceed5e6af73d8e9035ec9e
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                lxsyrsiW.pif
                • Path C:\Users\Public\Libraries\lxsyrsiW.pif
                • Size 66KB
                • SHA256 7bcdc2e607abc65ef93afd009c3048970d9e8d1c2a18fc571562396b13ebb301
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                alpha.pif
                • Path C:\Users\Public\alpha.pif
                • Size 231KB
                • SHA256 4d89fc34d5f0f9babd022271c585a9477bf41e834e46b991deaa0530fdb25e22
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                pha.pif
                • Path C:\Users\Public\pha.pif
                • Size 442KB
                • SHA256 9f914d42706fe215501044acd85a32d58aaef1419d404fddfa5d3b48f66ccd9f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                xpha.pif
                • Path C:\Users\Public\xpha.pif
                • Size 18KB
                • SHA256 4aaa74f294c15aeb37ada8185d0dead58bd87276a01a814abc0c4b40545bf2ef
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                netutils.dll
                • Path C:\Windows \SysWOW64\netutils.dll
                • Size 115KB
                • SHA256 1093d0809ed5223c8ea2d723032c0ee2bfd1d971ad6ac69904983ec545000b3d
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                per.exe
                • Path C:\Windows \SysWOW64\per.exe
                • Size 94KB
                • SHA256 0db4d3ffdb96d13cf3b427af8be66d985728c55ae254e4b67d287797e4c0b323
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                DiagnosticsHub.StandardCollector.Service.exe
                • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
                • Size 1.2MB
                • SHA256 0b7b9aee529539fab5e37abce9a91da5f5a152a1a35b6531b22de8d5d21a6ac3
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                FXSSVC.exe
                • Path C:\Windows\System32\FXSSVC.exe
                • Size 1.2MB
                • SHA256 ec87a5be4772b0c27f807fb6fe35e3d22b4994be8bae91a05a8613f11043a95f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                alg.exe
                • Path C:\Windows\System32\alg.exe
                • Size 1.2MB
                • SHA256 7aad2323ace615181ebdc1a0303ec854049a88c47a23a21ccb6f4a651a7c3ce2
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                AppVClient.exe
                • Path C:\Windows\system32\AppVClient.exe
                • Size 1.3MB
                • SHA256 51a0ced6ad45080bebf7eba74ab6f29037ac281bef544168cbd85a606bf28b9f
                • MD5 SHA1 SHA512 SSDEEP
                Submit Download

                memory/552-603-0x0000000140000000-0x000000014012F000-memory.dmp
                Download

                memory/552-926-0x0000000140000000-0x000000014012F000-memory.dmp
                Download

                memory/712-692-0x0000000005500000-0x0000000005592000-memory.dmp
                Download

                memory/712-665-0x0000000000B70000-0x0000000000BAE000-memory.dmp
                Download

                memory/900-316-0x0000027F58950000-0x0000027F58972000-memory.dmp
                Download

                memory/1380-707-0x0000000140000000-0x0000000140155000-memory.dmp
                Download

                memory/1380-928-0x0000000140000000-0x0000000140155000-memory.dmp
                Download

                memory/1876-548-0x0000000000400000-0x000000000058E000-memory.dmp
                Download

                memory/2356-876-0x0000000006C80000-0x0000000006CD0000-memory.dmp
                Download

                memory/2356-689-0x0000000005BF0000-0x0000000006194000-memory.dmp
                Download

                memory/2356-664-0x0000000000D10000-0x0000000000D54000-memory.dmp
                Download

                memory/2356-696-0x0000000005740000-0x00000000057A6000-memory.dmp
                Download

                memory/2356-877-0x0000000006D70000-0x0000000006E0C000-memory.dmp
                Download

                memory/2828-915-0x0000000005B80000-0x0000000005B8A000-memory.dmp
                Download

                memory/4260-706-0x0000000140000000-0x0000000140155000-memory.dmp
                Download

                memory/4260-690-0x0000000140000000-0x0000000140155000-memory.dmp
                Download

                memory/4328-907-0x0000000006410000-0x000000000642E000-memory.dmp
                Download

                memory/4328-834-0x0000000004FC0000-0x00000000055E8000-memory.dmp
                Download

                memory/4328-844-0x0000000004EE0000-0x0000000004F46000-memory.dmp
                Download

                memory/4328-842-0x0000000004D40000-0x0000000004D62000-memory.dmp
                Download

                memory/4328-855-0x0000000005850000-0x0000000005BA4000-memory.dmp
                Download

                memory/4328-860-0x0000000005E00000-0x0000000005E1E000-memory.dmp
                Download

                memory/4328-861-0x0000000005E20000-0x0000000005E6C000-memory.dmp
                Download

                memory/4328-896-0x00000000063D0000-0x0000000006402000-memory.dmp
                Download

                memory/4328-820-0x0000000004820000-0x0000000004856000-memory.dmp
                Download

                memory/4328-897-0x0000000070750000-0x000000007079C000-memory.dmp
                Download

                memory/4328-910-0x0000000007120000-0x000000000713A000-memory.dmp
                Download

                memory/4328-909-0x0000000007770000-0x0000000007DEA000-memory.dmp
                Download

                memory/4328-908-0x0000000007000000-0x00000000070A3000-memory.dmp
                Download

                memory/4328-911-0x0000000007190000-0x000000000719A000-memory.dmp
                Download

                memory/4328-912-0x00000000073A0000-0x0000000007436000-memory.dmp
                Download

                memory/4328-913-0x0000000007320000-0x0000000007331000-memory.dmp
                Download

                memory/4328-916-0x0000000007350000-0x000000000735E000-memory.dmp
                Download

                memory/4328-917-0x0000000007360000-0x0000000007374000-memory.dmp
                Download

                memory/4328-919-0x0000000007460000-0x000000000747A000-memory.dmp
                Download

                memory/4328-921-0x0000000007440000-0x0000000007448000-memory.dmp
                Download

                memory/4432-62-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-37-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-18-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-16-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-15-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-13-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-11-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-14-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-10-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-19-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-27-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-28-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-29-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-30-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-20-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-21-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-23-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-24-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-38-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-25-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-1-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-39-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-43-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-46-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-31-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-2-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-32-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-48-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-33-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-51-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-52-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-6-0x00000000022E0000-0x00000000022E1000-memory.dmp
                Download

                memory/4432-5-0x0000000000400000-0x0000000000512000-memory.dmp
                Download

                memory/4432-35-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-53-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-26-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-40-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-41-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-0-0x00000000022E0000-0x00000000022E1000-memory.dmp
                Download

                memory/4432-42-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-67-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-44-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-45-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-47-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-49-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-54-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-55-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-56-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-57-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-58-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-59-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-60-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-61-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-63-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-64-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-65-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-66-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-50-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-34-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-22-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-17-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-12-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-8-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-9-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4432-7-0x0000000002C40000-0x0000000003C40000-memory.dmp
                Download

                memory/4556-923-0x0000000140000000-0x0000000140130000-memory.dmp
                Download

                memory/4556-560-0x0000000140000000-0x0000000140130000-memory.dmp
                Download

                memory/4696-675-0x0000000140000000-0x000000014022B000-memory.dmp
                Download

                memory/4696-927-0x0000000140000000-0x000000014022B000-memory.dmp
                Download

                memory/4996-679-0x0000000140000000-0x0000000140135000-memory.dmp
                Download

                memory/4996-634-0x0000000140000000-0x0000000140135000-memory.dmp
                Download