Overview

overview

10

Static

static

5

Open_to_view.exe

windows10-2004-x64

10

Open_to_view.exe

windows11-ltsc_2024-x64

10

winhttp.dll

windows10-2004-x64

10

winhttp.dll

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    105s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    19/08/2026, 09:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    winhttp.dll
  • Size 378KB
  • Sample260819-ldlchaeb98
  • SHA256 c4b4205228f54be2422d69f9d7575c69d85a6ef0775118f6ac18eaf77e4b623c
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceransomwaretrojan

Malware Config

Extracted

Family

  • valleyrat_s2

Version

  • 1.0

C2

  • 207.56.119.83:6666

Attributes
  • campaign_date

    2026-08-16

Signatures

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2
  • Detects ValleyRAT payload 10 IoCs
  • Windows security bypass 2 TTPs 54 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 9 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 37 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Windows security bypass
    • Enumerates connected drives
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3264
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\winhttp.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2976
  • C:\ProgramData\EdgeUpdate\3k2jzc5v\6wm467ol.exe
    C:\ProgramData\EdgeUpdate\3k2jzc5v\6wm467ol.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:3812
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Windows security bypass
      • Enumerates connected drives
      • Suspicious use of SetWindowsHookEx
      PID:3140
  • C:\ProgramData\EdgeUpdate\esnefr0b\mp0u2ivj.exe
    C:\ProgramData\EdgeUpdate\esnefr0b\mp0u2ivj.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2328
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:2896
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Windows security bypass
      • Enumerates connected drives
      • Suspicious use of SetWindowsHookEx
      PID:112
  • C:\ProgramData\EdgeUpdate\eoes7mr3\wwgbfqeb.exe
    C:\ProgramData\EdgeUpdate\eoes7mr3\wwgbfqeb.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:4984
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Windows security bypass
      • Enumerates connected drives
      • Suspicious use of SetWindowsHookEx
      PID:1248
  • C:\ProgramData\EdgeUpdate\47hnka54\yeac1spc.exe
    C:\ProgramData\EdgeUpdate\47hnka54\yeac1spc.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:2752
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Windows security bypass
      • Enumerates connected drives
      • Suspicious use of SetWindowsHookEx
      PID:3896
  • C:\ProgramData\EdgeUpdate\eykjllaf\3vpaxg8b.exe
    C:\ProgramData\EdgeUpdate\eykjllaf\3vpaxg8b.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2140
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:1616
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Windows security bypass
      • Enumerates connected drives
      • Suspicious use of SetWindowsHookEx
      PID:5064
  • C:\ProgramData\EdgeUpdate\daudfyhc\ccfnmon2.exe
    C:\ProgramData\EdgeUpdate\daudfyhc\ccfnmon2.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2628
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:3652
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Windows security bypass
      • Enumerates connected drives
      • Suspicious use of SetWindowsHookEx
      PID:1008
  • C:\ProgramData\EdgeUpdate\foj5hslr\9joyixmp.exe
    C:\ProgramData\EdgeUpdate\foj5hslr\9joyixmp.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3560
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:2296
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Windows security bypass
      • Enumerates connected drives
      • Suspicious use of SetWindowsHookEx
      PID:3332
  • C:\ProgramData\EdgeUpdate\wdbxvo6i\blzpnlaq.exe
    C:\ProgramData\EdgeUpdate\wdbxvo6i\blzpnlaq.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:4172
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Windows security bypass
      • Enumerates connected drives
      • Suspicious use of SetWindowsHookEx
      PID:2240
  • C:\ProgramData\EdgeUpdate\sb2d0l5u\lb5q46dk.exe
    C:\ProgramData\EdgeUpdate\sb2d0l5u\lb5q46dk.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3404
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:892
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Enumerates connected drives
      • Suspicious use of SetWindowsHookEx
      PID:888
  • C:\ProgramData\EdgeUpdate\yat9j5u7\zt1hk4p6.exe
    C:\ProgramData\EdgeUpdate\yat9j5u7\zt1hk4p6.exe
    1⤵
      PID:4860
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
        2⤵
        • Command and Scripting Interpreter: PowerShell
        PID:5116
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        2⤵
          PID:372
      • C:\ProgramData\EdgeUpdate\rhq9nlkf\647kshej.exe
        C:\ProgramData\EdgeUpdate\rhq9nlkf\647kshej.exe
        1⤵
          PID:540
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
            2⤵
            • Command and Scripting Interpreter: PowerShell
            PID:1972
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe"
            2⤵
              PID:3288
          • C:\ProgramData\EdgeUpdate\ratpvltm\odp2nna6.exe
            C:\ProgramData\EdgeUpdate\ratpvltm\odp2nna6.exe
            1⤵
              PID:2052
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
                2⤵
                • Command and Scripting Interpreter: PowerShell
                PID:4436
              • C:\Windows\explorer.exe
                "C:\Windows\explorer.exe"
                2⤵
                  PID:1680
              • C:\ProgramData\EdgeUpdate\c4yx95rb\0x061b98.exe
                C:\ProgramData\EdgeUpdate\c4yx95rb\0x061b98.exe
                1⤵
                  PID:4888
                  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                    powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
                    2⤵
                    • Command and Scripting Interpreter: PowerShell
                    PID:4296
                  • C:\Windows\explorer.exe
                    "C:\Windows\explorer.exe"
                    2⤵
                      PID:1516

                  Network

                        MITRE ATT&CK Enterprise v16

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        6wm467ol.exe
                        • Path C:\ProgramData\EdgeUpdate\3k2jzc5v\6wm467ol.exe
                        • Size 350KB
                        • SHA256 56c244aded0313ebda795841c0db38dbe3e3321f5c9302cc166d5de39c417cb2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        config.log
                        • Path C:\ProgramData\EdgeUpdate\3k2jzc5v\config.log
                        • Size 350KB
                        • SHA256 b71dd8099864e9a3b17ccae293d14f701951ec4717076f8d8deb079e1735638d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        webview_support.dll
                        • Path C:\ProgramData\EdgeUpdate\3k2jzc5v\webview_support.dll
                        • Size 160KB
                        • SHA256 b36d1af98e073fa38b921b85aa1fee5617bc434e9ec2d52261563a5949cada68
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        webview_support.dll
                        • Path C:\ProgramData\EdgeUpdate\47hnka54\webview_support.dll
                        • Size 160KB
                        • SHA256 b3641008b923526fb36b0e6b3645e31240314db14364acb2551f87db197147b5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        webview_support.dll
                        • Path C:\ProgramData\EdgeUpdate\daudfyhc\webview_support.dll
                        • Size 160KB
                        • SHA256 22f236437d7e200331c33a81696ec6acbeeee7070ad8f5f3d5399067a92207ac
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        webview_support.dll
                        • Path C:\ProgramData\EdgeUpdate\eoes7mr3\webview_support.dll
                        • Size 160KB
                        • SHA256 5a4c25eae7cb186f627a68a51785c76e7b5ab80168913c7aca0cece4ee145271
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        webview_support.dll
                        • Path C:\ProgramData\EdgeUpdate\esnefr0b\webview_support.dll
                        • Size 160KB
                        • SHA256 5985a36354824314530ed077bec48226601110d25513621e1b4c54e2c7047a72
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        webview_support.dll
                        • Path C:\ProgramData\EdgeUpdate\eykjllaf\webview_support.dll
                        • Size 160KB
                        • SHA256 eea92f2843351d4b356f17965dca70adad4bc9e3f535384a442a4dcdb350cf96
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        webview_support.dll
                        • Path C:\ProgramData\EdgeUpdate\foj5hslr\webview_support.dll
                        • Size 160KB
                        • SHA256 0d7a2bd180d7e40d5eafeba1b071141c7098a2014a278c569740b0d8ecdc9689
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        webview_support.dll
                        • Path C:\ProgramData\EdgeUpdate\rhq9nlkf\webview_support.dll
                        • Size 160KB
                        • SHA256 1d625b677ccd6f09e5b8ed1f0889aeb8acd9f300072048d0c64fc97e961c5318
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        webview_support.dll
                        • Path C:\ProgramData\EdgeUpdate\sb2d0l5u\webview_support.dll
                        • Size 160KB
                        • SHA256 ec46b22d383243f43cb9c23ab70f548390d2cbeb20cadc4c0c7d30da1643e0a7
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        webview_support.dll
                        • Path C:\ProgramData\EdgeUpdate\wdbxvo6i\webview_support.dll
                        • Size 160KB
                        • SHA256 57890bca4f92a836a7f07c1d4a63be82ee19e34c7127c97a2bc48cffd80a4488
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        webview_support.dll
                        • Path C:\ProgramData\EdgeUpdate\yat9j5u7\webview_support.dll
                        • Size 160KB
                        • SHA256 3c4cc055ade0338566a392b006cec8cf919a95b558496f9eb80e62e7b2b839b2
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        powershell.exe.log
                        • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                        • Size 2KB
                        • SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 944B
                        • SHA256 da8b533f81b342503c109e46b081b5c5296fdad5481f93fe5cc648e49ca6238e
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 944B
                        • SHA256 7dfae8d592bc7eb4467c1700308bd519cf506be286b76b2dd0a3d300379a732c
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 944B
                        • SHA256 76d62e0d4675c784a5e089c4c3e383e0dca7a05cd236ee78af71c86cf8048c89
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 944B
                        • SHA256 fb0b3c822d300abbb892e6f218d6b4b62b80bb26d9184d1f4c731600053a3fc4
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 944B
                        • SHA256 67c8a69fa18a3bddcb4f6504f24d3de894a9e18627316bdbdfd56b0dbbb9a15c
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 944B
                        • SHA256 314b91c00997034d6e015f40230d90ebbf57de5dc938b62c1a214d591793dbe3
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 944B
                        • SHA256 ad07460e061642c0dd4e7dfa7b821aacce873e290389e72f708e9f3504f9d135
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 944B
                        • SHA256 9e94e7c9ac6134ee30e79498558aa1a5a1ac79a643666c3f8922eed215dd3a98
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        StartupProfileData-NonInteractive
                        • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        • Size 944B
                        • SHA256 c4a6c804bff7ebc42e6e792c344373eb41c5a65891b1ccdcd1c120fa529da0fc
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        __PSScriptPolicyTest_25dqtkbf.2zh.ps1
                        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_25dqtkbf.2zh.ps1
                        • Size 60B
                        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        memory/112-103-0x00000000008C0000-0x000000000091F000-memory.dmp
                        Download

                        memory/112-97-0x00000000008C0000-0x000000000091F000-memory.dmp
                        Download

                        memory/112-98-0x00000000008C0000-0x000000000091F000-memory.dmp
                        Download

                        memory/112-99-0x00000000008C0000-0x000000000091F000-memory.dmp
                        Download

                        memory/112-100-0x00000000008C0000-0x000000000091F000-memory.dmp
                        Download

                        memory/112-101-0x00000000008C0000-0x000000000091F000-memory.dmp
                        Download

                        memory/112-104-0x00000000008C0000-0x000000000091F000-memory.dmp
                        Download

                        memory/112-105-0x00000000008C0000-0x000000000091F000-memory.dmp
                        Download

                        memory/112-107-0x00000000008C0000-0x000000000091F000-memory.dmp
                        Download

                        memory/112-108-0x00000000008C0000-0x000000000091F000-memory.dmp
                        Download

                        memory/1248-152-0x0000000002C30000-0x0000000002C8F000-memory.dmp
                        Download

                        memory/1248-146-0x0000000002C30000-0x0000000002C8F000-memory.dmp
                        Download

                        memory/1248-145-0x0000000002C30000-0x0000000002C8F000-memory.dmp
                        Download

                        memory/1248-144-0x0000000002C30000-0x0000000002C8F000-memory.dmp
                        Download

                        memory/1248-143-0x0000000002C30000-0x0000000002C8F000-memory.dmp
                        Download

                        memory/1248-142-0x0000000002C30000-0x0000000002C8F000-memory.dmp
                        Download

                        memory/1248-148-0x0000000002C30000-0x0000000002C8F000-memory.dmp
                        Download

                        memory/1248-149-0x0000000002C30000-0x0000000002C8F000-memory.dmp
                        Download

                        memory/1248-150-0x0000000002C30000-0x0000000002C8F000-memory.dmp
                        Download

                        memory/1248-153-0x0000000002C30000-0x0000000002C8F000-memory.dmp
                        Download

                        memory/3140-52-0x0000000002380000-0x00000000023DF000-memory.dmp
                        Download

                        memory/3140-53-0x0000000002380000-0x00000000023DF000-memory.dmp
                        Download

                        memory/3140-55-0x00000000005A0000-0x00000000005F8000-memory.dmp
                        Download

                        memory/3140-62-0x0000000002380000-0x00000000023DF000-memory.dmp
                        Download

                        memory/3140-61-0x0000000002380000-0x00000000023DF000-memory.dmp
                        Download

                        memory/3140-59-0x0000000002380000-0x00000000023DF000-memory.dmp
                        Download

                        memory/3140-58-0x0000000002380000-0x00000000023DF000-memory.dmp
                        Download

                        memory/3140-57-0x0000000002380000-0x00000000023DF000-memory.dmp
                        Download

                        memory/3140-50-0x0000000002380000-0x00000000023DF000-memory.dmp
                        Download

                        memory/3140-51-0x0000000002380000-0x00000000023DF000-memory.dmp
                        Download

                        memory/3140-54-0x0000000002380000-0x00000000023DF000-memory.dmp
                        Download

                        memory/3264-2-0x0000000004880000-0x00000000048DF000-memory.dmp
                        Download

                        memory/3264-7-0x0000000004880000-0x00000000048DF000-memory.dmp
                        Download

                        memory/3264-81-0x0000000002660000-0x0000000002661000-memory.dmp
                        Download

                        memory/3264-170-0x00000000021B0000-0x00000000021B1000-memory.dmp
                        Download

                        memory/3264-11-0x0000000004880000-0x00000000048DF000-memory.dmp
                        Download

                        memory/3264-31-0x0000000002620000-0x0000000002621000-memory.dmp
                        Download

                        memory/3264-6-0x0000000004880000-0x00000000048DF000-memory.dmp
                        Download

                        memory/3264-5-0x0000000002A00000-0x0000000002A58000-memory.dmp
                        Download

                        memory/3264-3-0x0000000004880000-0x00000000048DF000-memory.dmp
                        Download

                        memory/3264-1-0x0000000004880000-0x00000000048DF000-memory.dmp
                        Download

                        memory/3264-0-0x0000000004880000-0x00000000048DF000-memory.dmp
                        Download

                        memory/3264-14-0x0000000180000000-0x0000000180103000-memory.dmp
                        Download

                        memory/3264-8-0x0000000004880000-0x00000000048DF000-memory.dmp
                        Download

                        memory/3264-4-0x0000000004880000-0x00000000048DF000-memory.dmp
                        Download

                        memory/3264-127-0x0000000002640000-0x0000000002641000-memory.dmp
                        Download

                        memory/3264-9-0x0000000004880000-0x00000000048DF000-memory.dmp
                        Download

                        memory/3264-217-0x0000000002650000-0x0000000002651000-memory.dmp
                        Download

                        memory/3812-38-0x0000029E3EDF0000-0x0000029E3EE00000-memory.dmp
                        Download

                        memory/3812-37-0x0000029E3EDF0000-0x0000029E3EE00000-memory.dmp
                        Download

                        memory/3812-39-0x0000029E26C10000-0x0000029E26C32000-memory.dmp
                        Download

                        memory/3896-197-0x0000000001EF0000-0x0000000001F4F000-memory.dmp
                        Download

                        memory/3896-198-0x0000000001EF0000-0x0000000001F4F000-memory.dmp
                        Download

                        memory/3896-189-0x0000000001EF0000-0x0000000001F4F000-memory.dmp
                        Download

                        memory/3896-191-0x0000000001EF0000-0x0000000001F4F000-memory.dmp
                        Download

                        memory/3896-190-0x0000000001EF0000-0x0000000001F4F000-memory.dmp
                        Download

                        memory/3896-188-0x0000000001EF0000-0x0000000001F4F000-memory.dmp
                        Download

                        memory/3896-187-0x0000000001EF0000-0x0000000001F4F000-memory.dmp
                        Download

                        memory/3896-193-0x0000000001EF0000-0x0000000001F4F000-memory.dmp
                        Download

                        memory/3896-194-0x0000000001EF0000-0x0000000001F4F000-memory.dmp
                        Download

                        memory/3896-195-0x0000000001EF0000-0x0000000001F4F000-memory.dmp
                        Download

                        memory/5064-238-0x0000000001130000-0x000000000118F000-memory.dmp
                        Download

                        memory/5064-232-0x0000000001130000-0x000000000118F000-memory.dmp
                        Download

                        memory/5064-236-0x0000000001130000-0x000000000118F000-memory.dmp
                        Download

                        memory/5064-242-0x0000000001130000-0x000000000118F000-memory.dmp
                        Download

                        memory/5064-240-0x0000000001130000-0x000000000118F000-memory.dmp
                        Download

                        memory/5064-235-0x0000000001130000-0x000000000118F000-memory.dmp
                        Download

                        memory/5064-239-0x0000000001130000-0x000000000118F000-memory.dmp
                        Download

                        memory/5064-233-0x0000000001130000-0x000000000118F000-memory.dmp
                        Download

                        memory/5064-234-0x0000000001130000-0x000000000118F000-memory.dmp
                        Download