valleyrat_s2 | 233086e7d57e16523ac3463df306cfc497a9ba3c3e8268f62c8625ef56b2380e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/06/2026, 12:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tax-Number919863.exe
Size 24KB
Sample260619-pfty7sg19v
SHA256 233086e7d57e16523ac3463df306cfc497a9ba3c3e8268f62c8625ef56b2380e
MD5 3c305f878c678e9017e3e53fb6020283
SHA1 b8f157d19017065ccad21e5ceae21184d0fc3e5d
SHA512 7783d325bf738dbbc2a35545e2aa31d672dbab7e255720d83a9da66ce885eb0a60853211e95748f8bd3bcd3c470f2a9e8d10bb767b02f8a14511cec6e748e7ec
SSDEEP 384:8qRg0yFtNq5Awt9F7heZBLy8RbmL4nNyGu0:eFnq5xtgBL5AL10
TLSH
T1B8B27C67CE500CCBFE1A8AB0A0E59227FC32B6999ED1D3C35378C1550F513817A9A2E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery valleyrat_s2 persistence

Malware Config

Extracted

Family

valleyrat_s2

Version

yk.ggdy.com:8003
yk.ggdy.com:80
103.97.131.186:8888
103.97.131.186:6666
103.97.128.141:7777

Attributes

campaign_date
2023. 6.30

Signatures

Family: ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2

Detects ValleyRAT payload 16 IoCs

resource	yara_rule
behavioral1/memory/2288-46-0x0000000003020000-0x0000000003059000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4480-50-0x00000000037B0000-0x00000000037E9000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/2288-51-0x0000000003020000-0x0000000003059000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/2280-55-0x0000000002D70000-0x0000000002DA9000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4480-56-0x00000000037B0000-0x00000000037E9000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/2280-57-0x0000000002D70000-0x0000000002DA9000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4764-63-0x0000000004200000-0x0000000004239000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4764-68-0x0000000004200000-0x0000000004239000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/2288-72-0x0000000003020000-0x0000000003059000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/2288-71-0x0000000003020000-0x0000000003059000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4480-73-0x00000000037B0000-0x00000000037E9000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4480-74-0x00000000037B0000-0x00000000037E9000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/2280-75-0x0000000002D70000-0x0000000002DA9000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/2280-76-0x0000000002D70000-0x0000000002DA9000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4764-77-0x0000000004200000-0x0000000004239000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/4764-78-0x0000000004200000-0x0000000004239000-memory.dmp	family_valleyrat_stage_2_v2

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\pcdhost.sys	Tax-Number919863.exe
File opened for modification	C:\Windows\System32\drivers\pcdhost.sys	Tax-Number919863.exe
File opened for modification	C:\Windows\System32\drivers\pcdhost.sys	Tax-Number919863.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\USB3YTHS = "cmd /c start \"\" /D \"C:\\ProgramData\\USB3YTHS\" Tax-Number919863.exe"	Tax-Number919863.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	ngen.exe
File opened (read-only)	\??\H:	ngen.exe
File opened (read-only)	\??\P:	ngen.exe
File opened (read-only)	\??\M:	ngen.exe
File opened (read-only)	\??\W:	ngen.exe
File opened (read-only)	\??\I:	ngen.exe
File opened (read-only)	\??\R:	ngen.exe
File opened (read-only)	\??\P:	ngen.exe
File opened (read-only)	\??\R:	ngen.exe
File opened (read-only)	\??\B:	ngen.exe
File opened (read-only)	\??\Q:	ngen.exe
File opened (read-only)	\??\J:	ngen.exe
File opened (read-only)	\??\P:	ngen.exe
File opened (read-only)	\??\X:	ngen.exe
File opened (read-only)	\??\Q:	ngen.exe
File opened (read-only)	\??\T:	ngen.exe
File opened (read-only)	\??\N:	ngen.exe
File opened (read-only)	\??\X:	ngen.exe
File opened (read-only)	\??\G:	ngen.exe
File opened (read-only)	\??\H:	ngen.exe
File opened (read-only)	\??\K:	ngen.exe
File opened (read-only)	\??\S:	ngen.exe
File opened (read-only)	\??\J:	ngen.exe
File opened (read-only)	\??\Y:	ngen.exe
File opened (read-only)	\??\S:	ngen.exe
File opened (read-only)	\??\Z:	ngen.exe
File opened (read-only)	\??\I:	ngen.exe
File opened (read-only)	\??\B:	ngen.exe
File opened (read-only)	\??\H:	ngen.exe
File opened (read-only)	\??\N:	ngen.exe
File opened (read-only)	\??\I:	ngen.exe
File opened (read-only)	\??\V:	ngen.exe
File opened (read-only)	\??\Z:	ngen.exe
File opened (read-only)	\??\Q:	ngen.exe
File opened (read-only)	\??\Z:	ngen.exe
File opened (read-only)	\??\B:	ngen.exe
File opened (read-only)	\??\O:	ngen.exe
File opened (read-only)	\??\L:	ngen.exe
File opened (read-only)	\??\N:	ngen.exe
File opened (read-only)	\??\P:	ngen.exe
File opened (read-only)	\??\X:	ngen.exe
File opened (read-only)	\??\G:	ngen.exe
File opened (read-only)	\??\K:	ngen.exe
File opened (read-only)	\??\R:	ngen.exe
File opened (read-only)	\??\Y:	ngen.exe
File opened (read-only)	\??\E:	ngen.exe
File opened (read-only)	\??\R:	ngen.exe
File opened (read-only)	\??\W:	ngen.exe
File opened (read-only)	\??\E:	ngen.exe
File opened (read-only)	\??\T:	ngen.exe
File opened (read-only)	\??\O:	ngen.exe
File opened (read-only)	\??\Q:	ngen.exe
File opened (read-only)	\??\T:	ngen.exe
File opened (read-only)	\??\L:	ngen.exe
File opened (read-only)	\??\T:	ngen.exe
File opened (read-only)	\??\V:	ngen.exe
File opened (read-only)	\??\Z:	ngen.exe
File opened (read-only)	\??\G:	ngen.exe
File opened (read-only)	\??\W:	ngen.exe
File opened (read-only)	\??\L:	ngen.exe
File opened (read-only)	\??\S:	ngen.exe
File opened (read-only)	\??\H:	ngen.exe
File opened (read-only)	\??\V:	ngen.exe
File opened (read-only)	\??\E:	ngen.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	cmd.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 3284 set thread context of 2288	3284	Tax-Number919863.exe	92
PID 3284 set thread context of 4480	3284	Tax-Number919863.exe	100
PID 736 set thread context of 2280	736	Tax-Number919863.exe	101
PID 736 set thread context of 4764	736	Tax-Number919863.exe	103

Executes dropped EXE 2 IoCs

pid	Process
1828	pcdhost.sys
736	Tax-Number919863.exe

Loads dropped DLL 1 IoCs

pid	Process
736	Tax-Number919863.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ngen.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe
2288	ngen.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2288	ngen.exe
4480	ngen.exe
2280	ngen.exe
4764	ngen.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 2288	3284	Tax-Number919863.exe	92
PID 3284 wrote to memory of 2288	3284	Tax-Number919863.exe	92
PID 3284 wrote to memory of 2288	3284	Tax-Number919863.exe	92
PID 3284 wrote to memory of 2288	3284	Tax-Number919863.exe	92
PID 3284 wrote to memory of 2288	3284	Tax-Number919863.exe	92
PID 3284 wrote to memory of 2288	3284	Tax-Number919863.exe	92
PID 3284 wrote to memory of 2288	3284	Tax-Number919863.exe	92
PID 4300 wrote to memory of 736	4300	cmd.exe	97
PID 3284 wrote to memory of 4480	3284	Tax-Number919863.exe	100
PID 3284 wrote to memory of 4480	3284	Tax-Number919863.exe	100
PID 3284 wrote to memory of 4480	3284	Tax-Number919863.exe	100
PID 3284 wrote to memory of 4480	3284	Tax-Number919863.exe	100
PID 3284 wrote to memory of 4480	3284	Tax-Number919863.exe	100
PID 3284 wrote to memory of 4480	3284	Tax-Number919863.exe	100
PID 3284 wrote to memory of 4480	3284	Tax-Number919863.exe	100
PID 736 wrote to memory of 2280	736	Tax-Number919863.exe	101
PID 736 wrote to memory of 2280	736	Tax-Number919863.exe	101
PID 736 wrote to memory of 2280	736	Tax-Number919863.exe	101
PID 736 wrote to memory of 2280	736	Tax-Number919863.exe	101
PID 736 wrote to memory of 2280	736	Tax-Number919863.exe	101
PID 736 wrote to memory of 2280	736	Tax-Number919863.exe	101
PID 736 wrote to memory of 2280	736	Tax-Number919863.exe	101
PID 736 wrote to memory of 4764	736	Tax-Number919863.exe	103
PID 736 wrote to memory of 4764	736	Tax-Number919863.exe	103
PID 736 wrote to memory of 4764	736	Tax-Number919863.exe	103
PID 736 wrote to memory of 4764	736	Tax-Number919863.exe	103
PID 736 wrote to memory of 4764	736	Tax-Number919863.exe	103
PID 736 wrote to memory of 4764	736	Tax-Number919863.exe	103
PID 736 wrote to memory of 4764	736	Tax-Number919863.exe	103

C:\Users\Admin\AppData\Local\Temp\Tax-Number919863.exe
"C:\Users\Admin\AppData\Local\Temp\Tax-Number919863.exe"
1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:2288
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4480

C:\Windows\System32\drivers\pcdhost.sys
C:\Windows\System32\drivers\pcdhost.sys
1⤵
- Executes dropped EXE
PID:1828

C:\Windows\system32\cmd.exe
"cmd /c start "" /D "C:\ProgramData\USB3YTHS" Tax-Number919863.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4300
- C:\ProgramData\USB3YTHS\Tax-Number919863.exe
  "C:\ProgramData\USB3YTHS\Tax-Number919863.exe"
  2⤵
  - Drops file in Drivers directory
  - Suspicious use of SetThreadContext
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:736
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2280
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"
    3⤵
    - Enumerates connected drives
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Tax-Number919863.exe

Path C:\ProgramData\USB3YTHS\Tax-Number919863.exe
Size 24KB
SHA256 233086e7d57e16523ac3463df306cfc497a9ba3c3e8268f62c8625ef56b2380e
MD5 3c305f878c678e9017e3e53fb6020283
SHA1 b8f157d19017065ccad21e5ceae21184d0fc3e5d
SHA512 7783d325bf738dbbc2a35545e2aa31d672dbab7e255720d83a9da66ce885eb0a60853211e95748f8bd3bcd3c470f2a9e8d10bb767b02f8a14511cec6e748e7ec
SSDEEP 384:8qRg0yFtNq5Awt9F7heZBLy8RbmL4nNyGu0:eFnq5xtgBL5AL10
TLSH
T1B8B27C67CE500CCBFE1A8AB0A0E59227FC32B6999ED1D3C35378C1550F513817A9A2E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20260619131922.jpg

Path C:\ProgramData\quickScreenShot\20260619\20260619131922.jpg
Size 106KB
SHA256 ff602482f1a5dfa768f5e61550b3b7bfcaea4287ebfee299f0abcf2dcb429bed
MD5 b04794db5b708f7de9ce8118b79fd3b5
SHA1 6e4a1c12e14d5ab746d78d62d4bd6e2733bfced7
SHA512 657b0c729073f1679bcb0e56c7b4860facf942f467a2bda39d9b91b201fbfb0190859feb074db02dcf70974f52f3e91d5981e9fa6a3d07377b047260d4893709
SSDEEP 1536:IWhwaTQ8K5MWiwtOOM0NWgClqyeuYlT7n12e0qlYg2Db5TlLFP1ZL/a:UL5MKM4iqy6pJ0DgKbrZP1RC
TLSH
T100B3445FFBD8F84B002B937798BE574A6B17B362963B66D4D08F8D85122B1811937CE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

20260619132024.jpg

Path C:\ProgramData\quickScreenShot\20260619\20260619132024.jpg
Size 106KB
SHA256 8abc634f1b70fc005808cbd2636182c9fac23e0fb09631deca16eac18476a9cf
MD5 4a2ad5e7c1477e8bd9cbf7e818b530b6
SHA1 1559a9824e112f76022e5dde83646b92a020826d
SHA512 1597b7db11f30174cfacbbd0205986ca39245e3e09e9b0ba6023a813122f8dffb6757a130603fb9642a8e0de66e9d52652241c218f971aceaf88965e141a406f
SSDEEP 1536:IWhwaTQ8K5MWiwtOOM0NWgClqyeuYlT7n12e0qlYg2Db5TlLFP1ZL/9:UL5MKM4iqy6pJ0DgKbrZP1RV
TLSH
T1EDB3545FFBD4F84B002B537798BE574A6B17B362963B66D4D04F8D85122B2812937CE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pcdhost.sys

Path C:\Windows\System32\drivers\pcdhost.sys
Size 17KB
SHA256 07c5209bf83065fe760f4fee4ed2308b0c523671f68ca73a3854c2c8c28c0541
MD5 826c6d2e3d80f2d43f7977f998525ad3
SHA1 7340eae2ccf3d57ac3ae271c9983996d8ae7fde0
SHA512 162954793c2e734fbbbef058b31d91de4df13c019af7c1f33135f0cd98113d0c88ea423faaabf435fd96b7bb002c51b6b4fc6ac1748eab131badb51866b59767
SSDEEP 192:JgvuYacCCpQIw9l0HKs0zTQxmnYe+PjP4wBjtlAv6YHmVm1OoG:JsuoCCpQIY0HKs0vkmnYPL4OUSYGVm1k
TLSH
T1BF826D8B476920AAFAE7C935C2A18677FC30FAD077564AFF4119C1911E81FE05B3D209
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1828-2-0x0000000000010000-0x0000000000017000-memory.dmp

Download

memory/2280-28-0x0000000000750000-0x00000000007A0000-memory.dmp

Download

memory/2280-31-0x0000000000750000-0x00000000007A0000-memory.dmp

Download

memory/2280-53-0x0000000000750000-0x00000000007A0000-memory.dmp

Download

memory/2280-54-0x0000000000750000-0x00000000007A0000-memory.dmp

Download

memory/2280-55-0x0000000002D70000-0x0000000002DA9000-memory.dmp

Download

memory/2280-57-0x0000000002D70000-0x0000000002DA9000-memory.dmp

Download

memory/2280-76-0x0000000002D70000-0x0000000002DA9000-memory.dmp

Download

memory/2280-75-0x0000000002D70000-0x0000000002DA9000-memory.dmp

Download

memory/2280-66-0x0000000000750000-0x00000000007A0000-memory.dmp

Download

memory/2280-67-0x0000000000750000-0x00000000007A0000-memory.dmp

Download

memory/2280-29-0x0000000000750000-0x00000000007A0000-memory.dmp

Download

memory/2280-52-0x0000000000750000-0x00000000007A0000-memory.dmp

Download

memory/2280-30-0x0000000000750000-0x00000000007A0000-memory.dmp

Download

memory/2288-71-0x0000000003020000-0x0000000003059000-memory.dmp

Download

memory/2288-44-0x0000000000570000-0x00000000005C0000-memory.dmp

Download

memory/2288-8-0x0000000000570000-0x00000000005C0000-memory.dmp

Download

memory/2288-59-0x0000000000570000-0x00000000005C0000-memory.dmp

Download

memory/2288-41-0x0000000000570000-0x00000000005C0000-memory.dmp

Download

memory/2288-58-0x0000000000570000-0x00000000005C0000-memory.dmp

Download

memory/2288-43-0x0000000000570000-0x00000000005C0000-memory.dmp

Download

memory/2288-72-0x0000000003020000-0x0000000003059000-memory.dmp

Download

memory/2288-45-0x0000000000570000-0x00000000005C0000-memory.dmp

Download

memory/2288-46-0x0000000003020000-0x0000000003059000-memory.dmp

Download

memory/2288-6-0x0000000000570000-0x00000000005C0000-memory.dmp

Download

memory/2288-7-0x0000000000570000-0x00000000005C0000-memory.dmp

Download

memory/2288-5-0x0000000000570000-0x00000000005C0000-memory.dmp

Download

memory/2288-9-0x0000000000570000-0x00000000005C0000-memory.dmp

Download

memory/2288-51-0x0000000003020000-0x0000000003059000-memory.dmp

Download

memory/2288-10-0x0000000000570000-0x00000000005C0000-memory.dmp

Download

memory/4480-49-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4480-50-0x00000000037B0000-0x00000000037E9000-memory.dmp

Download

memory/4480-47-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4480-56-0x00000000037B0000-0x00000000037E9000-memory.dmp

Download

memory/4480-48-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4480-42-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4480-20-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4480-25-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4480-21-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4480-22-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4480-23-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4480-64-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4480-65-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4480-74-0x00000000037B0000-0x00000000037E9000-memory.dmp

Download

memory/4480-73-0x00000000037B0000-0x00000000037E9000-memory.dmp

Download

memory/4480-24-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4764-60-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4764-70-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4764-69-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4764-36-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4764-68-0x0000000004200000-0x0000000004239000-memory.dmp

Download

memory/4764-37-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4764-63-0x0000000004200000-0x0000000004239000-memory.dmp

Download

memory/4764-62-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4764-77-0x0000000004200000-0x0000000004239000-memory.dmp

Download

memory/4764-78-0x0000000004200000-0x0000000004239000-memory.dmp

Download

memory/4764-61-0x0000000000400000-0x0000000000450000-memory.dmp

Download

memory/4764-38-0x0000000000400000-0x0000000000450000-memory.dmp

Download