Overview

overview

10

Static

static

5

StatementofAccoun.exe

windows10-2004-x64

10

wmicodegen.dll

windows10-2004-x64

10

wmicodegen.dll

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    97s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    27/08/2026, 19:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    wmicodegen.dll
  • Size 377KB
  • Sample260827-xt4dssyyay
  • SHA256 3fb86b9f8d2751a061ad6afb9e9e28362d67473d60214ebf82a3c3806ced0f55
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
backdoordefense_evasiondiscoveryexecutionvalleyrat_s2persistenceransomwaretrojan

Malware Config

Extracted

Family

  • valleyrat_s2

Version

  • 1.0

C2

  • 47.75.119.86:5353

Attributes
  • campaign_date

    2026-08-12

Signatures

  • Family: ValleyRat

    ValleyRat stage2 is a backdoor written in C++.

    backdoorvalleyrat_s2
  • Detects ValleyRAT payload 11 IoCs
  • Windows security bypass 2 TTPs 48 IoCs
    defense_evasiontrojan
  • Command and Scripting Interpreter: PowerShell 1 TTPs 12 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 8 IoCs
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Windows security bypass
    • Enumerates connected drives
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3272
    • C:\Windows\system32\rundll32.exe
      rundll32.exe C:\Users\Admin\AppData\Local\Temp\wmicodegen.dll,#1
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1572
  • C:\ProgramData\EdgeUpdate\y03jswo6\z6bi3dtt.exe
    C:\ProgramData\EdgeUpdate\y03jswo6\z6bi3dtt.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:4808
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Windows security bypass
      • Enumerates connected drives
      • Suspicious use of SetWindowsHookEx
      PID:4472
  • C:\ProgramData\EdgeUpdate\12qim9cy\0804fnlm.exe
    C:\ProgramData\EdgeUpdate\12qim9cy\0804fnlm.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3420
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:3980
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Windows security bypass
      • Enumerates connected drives
      • Suspicious use of SetWindowsHookEx
      PID:3788
  • C:\ProgramData\EdgeUpdate\lsuje6s5\19d7v5lx.exe
    C:\ProgramData\EdgeUpdate\lsuje6s5\19d7v5lx.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3140
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:3028
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Windows security bypass
      • Enumerates connected drives
      • Suspicious use of SetWindowsHookEx
      PID:4108
  • C:\ProgramData\EdgeUpdate\vkp3ow91\mx0893y5.exe
    C:\ProgramData\EdgeUpdate\vkp3ow91\mx0893y5.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3080
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:376
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Windows security bypass
      • Enumerates connected drives
      • Suspicious use of SetWindowsHookEx
      PID:4876
  • C:\ProgramData\EdgeUpdate\nei2lu86\dm52c0f7.exe
    C:\ProgramData\EdgeUpdate\nei2lu86\dm52c0f7.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:896
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Windows security bypass
      • Enumerates connected drives
      • Suspicious use of SetWindowsHookEx
      PID:2016
  • C:\ProgramData\EdgeUpdate\kypw29dp\appyzumn.exe
    C:\ProgramData\EdgeUpdate\kypw29dp\appyzumn.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1944
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:3688
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Windows security bypass
      • Enumerates connected drives
      • Suspicious use of SetWindowsHookEx
      PID:436
  • C:\ProgramData\EdgeUpdate\uvy7tpx8\lhw89fwd.exe
    C:\ProgramData\EdgeUpdate\uvy7tpx8\lhw89fwd.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3492
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious use of AdjustPrivilegeToken
      PID:4796
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Windows security bypass
      • Enumerates connected drives
      • Suspicious use of SetWindowsHookEx
      PID:756
  • C:\ProgramData\EdgeUpdate\cyjk85o2\e2jjpyu7.exe
    C:\ProgramData\EdgeUpdate\cyjk85o2\e2jjpyu7.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:4280
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      PID:1872
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
        PID:3728
    • C:\ProgramData\EdgeUpdate\8tekqmh6\wsupmve4.exe
      C:\ProgramData\EdgeUpdate\8tekqmh6\wsupmve4.exe
      1⤵
        PID:3960
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
          2⤵
          • Command and Scripting Interpreter: PowerShell
          PID:8
        • C:\Windows\explorer.exe
          "C:\Windows\explorer.exe"
          2⤵
            PID:4284
        • C:\ProgramData\EdgeUpdate\uiemr6b8\sfwrwuaw.exe
          C:\ProgramData\EdgeUpdate\uiemr6b8\sfwrwuaw.exe
          1⤵
            PID:1012
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
              2⤵
              • Command and Scripting Interpreter: PowerShell
              PID:3516
            • C:\Windows\explorer.exe
              "C:\Windows\explorer.exe"
              2⤵
                PID:4828
            • C:\ProgramData\EdgeUpdate\jvpktrbm\w5ybh9bk.exe
              C:\ProgramData\EdgeUpdate\jvpktrbm\w5ybh9bk.exe
              1⤵
                PID:2800
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
                  2⤵
                  • Command and Scripting Interpreter: PowerShell
                  PID:3944
                • C:\Windows\explorer.exe
                  "C:\Windows\explorer.exe"
                  2⤵
                    PID:4260
                • C:\ProgramData\EdgeUpdate\1rjmh7fo\seuho64t.exe
                  C:\ProgramData\EdgeUpdate\1rjmh7fo\seuho64t.exe
                  1⤵
                    PID:1280
                    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                      powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "Add-MpPreference -ExclusionPath 'C:\ProgramData\EdgeUpdate'; Add-MpPreference -ExclusionProcess 'explorer.exe','Thunder.exe','RuntimeBroker.exe'"
                      2⤵
                      • Command and Scripting Interpreter: PowerShell
                      PID:1416
                    • C:\Windows\explorer.exe
                      "C:\Windows\explorer.exe"
                      2⤵
                        PID:3552

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          webview_support.dll
                          • Path C:\ProgramData\EdgeUpdate\12qim9cy\webview_support.dll
                          • Size 160KB
                          • SHA256 d5e7e476e36636e14ee4c071c16ce6ececd48f916ba529cc3e7c4e250b5e2885
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          webview_support.dll
                          • Path C:\ProgramData\EdgeUpdate\8tekqmh6\webview_support.dll
                          • Size 160KB
                          • SHA256 38756e026863e75e50208c7ecc7160cb05deb0e7ec6b2db4ea0e6b13f86856a6
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          webview_support.dll
                          • Path C:\ProgramData\EdgeUpdate\cyjk85o2\webview_support.dll
                          • Size 160KB
                          • SHA256 be690916c8b6fc523664e1e95a2a168a58b60ff9297dc6333d2d38a2a965d19a
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          webview_support.dll
                          • Path C:\ProgramData\EdgeUpdate\jvpktrbm\webview_support.dll
                          • Size 160KB
                          • SHA256 51c1dc9ec146fbc921bdbbb470fc67db49b2a715594600d20e14648f6eb34630
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          webview_support.dll
                          • Path C:\ProgramData\EdgeUpdate\kypw29dp\webview_support.dll
                          • Size 160KB
                          • SHA256 cec9daabe84f0410efd284a0fe3c3a9864d25efde9049ce72d214391e58d5554
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          webview_support.dll
                          • Path C:\ProgramData\EdgeUpdate\lsuje6s5\webview_support.dll
                          • Size 160KB
                          • SHA256 51e9141e7817aa7e9d6303fbe7727aa94249ee27845b4423e74dcef8fc1fe4cc
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          webview_support.dll
                          • Path C:\ProgramData\EdgeUpdate\nei2lu86\webview_support.dll
                          • Size 160KB
                          • SHA256 a1eff935fd02a12b4915eaa1dd4b522da417024eab462f847ee5f5d048f07089
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          webview_support.dll
                          • Path C:\ProgramData\EdgeUpdate\uiemr6b8\webview_support.dll
                          • Size 160KB
                          • SHA256 0fdf30c284e1b7f5124687175f6d43e50a647b6d4d8020c8a45d047849c2b4b2
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          webview_support.dll
                          • Path C:\ProgramData\EdgeUpdate\uvy7tpx8\webview_support.dll
                          • Size 160KB
                          • SHA256 8760c8cea2cb7416638dd65043a51015fcc1fb9028f4ea2f857c09fedee899b2
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          webview_support.dll
                          • Path C:\ProgramData\EdgeUpdate\vkp3ow91\webview_support.dll
                          • Size 160KB
                          • SHA256 ad3cd479d631570fcc3ccd4bd21f9e703fd21380e3002060c5e6e571dd070aca
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          config.log
                          • Path C:\ProgramData\EdgeUpdate\y03jswo6\config.log
                          • Size 350KB
                          • SHA256 23c8cf3e6a62ada2c5d5e52781410b44a1e383625430069da95cbc1720010818
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          webview_support.dll
                          • Path C:\ProgramData\EdgeUpdate\y03jswo6\webview_support.dll
                          • Size 160KB
                          • SHA256 e682dc8149959669fc5b7955375f75cf88ae9b32766e36fbebd6005a1e8bdbff
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          z6bi3dtt.exe
                          • Path C:\ProgramData\EdgeUpdate\y03jswo6\z6bi3dtt.exe
                          • Size 350KB
                          • SHA256 56c244aded0313ebda795841c0db38dbe3e3321f5c9302cc166d5de39c417cb2
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          powershell.exe.log
                          • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
                          • Size 4KB
                          • SHA256 e3274ce8296f2cd20e3189576fbadbfa0f1817cdf313487945c80e968589a495
                          • MD5 SHA1 SHA512 SSDEEP TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 38742f977d8096faefdfcb20551d049057b40dfbd25463b82e2ffc53d1750db4
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 ed64894a13a17f3c95a3aba90b450a621a9288406e8d8cb498113008df8ba872
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 efb9ecfe7c1a909d213c488072804f6d09d40ef60e8f5cb5d62dcbb80e9cb64d
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 24e5825615790cf0ed7350cce8bea63cbf3d47428a6bd26ce54d44bdab42081f
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 9897ad03faf215e59eada73f29494197103f6470a08ffb52072017e6f22f9e8f
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 510dc85bfdfed92c5994f6e0282198e2eb24c8918fa62f822015b119d8dc8d87
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 4778c18132f9344cef4a6044c2398e491f32dcec723975ad0a674d97438a256b
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 71eb1bceed4c5de6952e26225ddeafad918161eb1395c29d078a438ef7331e66
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          StartupProfileData-NonInteractive
                          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                          • Size 1KB
                          • SHA256 53494b01b980c81fca5ea08056ccada96096e7a5f04f2781c1ccf2fd503f1aa5
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          __PSScriptPolicyTest_xsfpqnds.xe0.ps1
                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xsfpqnds.xe0.ps1
                          • Size 60B
                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                          • MD5 SHA1 SHA512 TLSH
                          Submit Download

                          memory/8-490-0x0000017AFDD40000-0x0000017AFDDF5000-memory.dmp
                          Download

                          memory/376-226-0x0000021EC8910000-0x0000021EC89C5000-memory.dmp
                          Download

                          memory/1872-437-0x00000270D0DE0000-0x00000270D0E95000-memory.dmp
                          Download

                          memory/2016-284-0x0000000000780000-0x00000000007DF000-memory.dmp
                          Download

                          memory/2016-281-0x0000000000780000-0x00000000007DF000-memory.dmp
                          Download

                          memory/2016-285-0x0000000000780000-0x00000000007DF000-memory.dmp
                          Download

                          memory/2016-292-0x0000000000780000-0x00000000007DF000-memory.dmp
                          Download

                          memory/2016-291-0x0000000000780000-0x00000000007DF000-memory.dmp
                          Download

                          memory/2016-289-0x0000000000780000-0x00000000007DF000-memory.dmp
                          Download

                          memory/2016-288-0x0000000000780000-0x00000000007DF000-memory.dmp
                          Download

                          memory/2016-287-0x0000000000780000-0x00000000007DF000-memory.dmp
                          Download

                          memory/2016-282-0x0000000000780000-0x00000000007DF000-memory.dmp
                          Download

                          memory/2016-283-0x0000000000780000-0x00000000007DF000-memory.dmp
                          Download

                          memory/3028-171-0x000001EAC8660000-0x000001EAC8715000-memory.dmp
                          Download

                          memory/3272-29-0x00000000033C0000-0x00000000033C1000-memory.dmp
                          Download

                          memory/3272-257-0x00000000034A0000-0x00000000034A1000-memory.dmp
                          Download

                          memory/3272-7-0x00000000080E0000-0x000000000813F000-memory.dmp
                          Download

                          memory/3272-8-0x00000000080E0000-0x000000000813F000-memory.dmp
                          Download

                          memory/3272-97-0x0000000001070000-0x0000000001071000-memory.dmp
                          Download

                          memory/3272-0-0x0000000003430000-0x0000000003488000-memory.dmp
                          Download

                          memory/3272-11-0x00000000080E0000-0x000000000813F000-memory.dmp
                          Download

                          memory/3272-12-0x00000000080E0000-0x000000000813F000-memory.dmp
                          Download

                          memory/3272-1-0x00000000080E0000-0x000000000813F000-memory.dmp
                          Download

                          memory/3272-6-0x00000000080E0000-0x000000000813F000-memory.dmp
                          Download

                          memory/3272-5-0x00000000080E0000-0x000000000813F000-memory.dmp
                          Download

                          memory/3272-14-0x0000000180000000-0x0000000180103000-memory.dmp
                          Download

                          memory/3272-2-0x00000000080E0000-0x000000000813F000-memory.dmp
                          Download

                          memory/3272-204-0x0000000002B80000-0x0000000002B81000-memory.dmp
                          Download

                          memory/3272-9-0x00000000080E0000-0x000000000813F000-memory.dmp
                          Download

                          memory/3272-151-0x0000000001050000-0x0000000001051000-memory.dmp
                          Download

                          memory/3272-3-0x00000000080E0000-0x000000000813F000-memory.dmp
                          Download

                          memory/3516-543-0x000001BC3FDD0000-0x000001BC3FE85000-memory.dmp
                          Download

                          memory/3788-133-0x00000000025A0000-0x00000000025FF000-memory.dmp
                          Download

                          memory/3788-124-0x00000000025A0000-0x00000000025FF000-memory.dmp
                          Download

                          memory/3788-131-0x00000000025A0000-0x00000000025FF000-memory.dmp
                          Download

                          memory/3788-130-0x00000000025A0000-0x00000000025FF000-memory.dmp
                          Download

                          memory/3788-129-0x00000000025A0000-0x00000000025FF000-memory.dmp
                          Download

                          memory/3788-134-0x00000000025A0000-0x00000000025FF000-memory.dmp
                          Download

                          memory/3788-127-0x00000000025A0000-0x00000000025FF000-memory.dmp
                          Download

                          memory/3788-126-0x00000000025A0000-0x00000000025FF000-memory.dmp
                          Download

                          memory/3788-123-0x00000000025A0000-0x00000000025FF000-memory.dmp
                          Download

                          memory/3788-125-0x00000000025A0000-0x00000000025FF000-memory.dmp
                          Download

                          memory/3980-120-0x0000019A422F0000-0x0000019A423A5000-memory.dmp
                          Download

                          memory/4108-177-0x0000000002100000-0x000000000215F000-memory.dmp
                          Download

                          memory/4108-184-0x0000000002100000-0x000000000215F000-memory.dmp
                          Download

                          memory/4108-186-0x0000000002100000-0x000000000215F000-memory.dmp
                          Download

                          memory/4108-183-0x0000000002100000-0x000000000215F000-memory.dmp
                          Download

                          memory/4108-182-0x0000000002100000-0x000000000215F000-memory.dmp
                          Download

                          memory/4108-178-0x0000000002100000-0x000000000215F000-memory.dmp
                          Download

                          memory/4108-179-0x0000000002100000-0x000000000215F000-memory.dmp
                          Download

                          memory/4108-180-0x0000000002100000-0x000000000215F000-memory.dmp
                          Download

                          memory/4108-176-0x0000000002100000-0x000000000215F000-memory.dmp
                          Download

                          memory/4472-68-0x0000000002A50000-0x0000000002AAF000-memory.dmp
                          Download

                          memory/4472-79-0x0000000002A50000-0x0000000002AAF000-memory.dmp
                          Download

                          memory/4472-73-0x0000000000D20000-0x0000000000D78000-memory.dmp
                          Download

                          memory/4472-72-0x0000000002A50000-0x0000000002AAF000-memory.dmp
                          Download

                          memory/4472-71-0x0000000002A50000-0x0000000002AAF000-memory.dmp
                          Download

                          memory/4472-70-0x0000000002A50000-0x0000000002AAF000-memory.dmp
                          Download

                          memory/4472-69-0x0000000002A50000-0x0000000002AAF000-memory.dmp
                          Download

                          memory/4472-75-0x0000000002A50000-0x0000000002AAF000-memory.dmp
                          Download

                          memory/4472-76-0x0000000002A50000-0x0000000002AAF000-memory.dmp
                          Download

                          memory/4472-77-0x0000000002A50000-0x0000000002AAF000-memory.dmp
                          Download

                          memory/4472-80-0x0000000002A50000-0x0000000002AAF000-memory.dmp
                          Download

                          memory/4796-384-0x0000029EEC140000-0x0000029EEC1F5000-memory.dmp
                          Download

                          memory/4808-56-0x0000021B20D90000-0x0000021B20E45000-memory.dmp
                          Download

                          memory/4808-61-0x0000021B211C0000-0x0000021B211C8000-memory.dmp
                          Download

                          memory/4808-37-0x0000021B1FBF0000-0x0000021B1FC00000-memory.dmp
                          Download

                          memory/4808-40-0x0000021B1FBC0000-0x0000021B1FBE2000-memory.dmp
                          Download

                          memory/4808-46-0x00007FF46C3D0000-0x00007FF46C3E0000-memory.dmp
                          Download

                          memory/4808-48-0x0000021B1FBF0000-0x0000021B1FC00000-memory.dmp
                          Download

                          memory/4808-62-0x0000021B211F0000-0x0000021B211F6000-memory.dmp
                          Download

                          memory/4808-55-0x0000021B20D70000-0x0000021B20D8C000-memory.dmp
                          Download

                          memory/4808-57-0x0000021B20E50000-0x0000021B20E5A000-memory.dmp
                          Download

                          memory/4808-64-0x0000021B1FBF0000-0x0000021B1FC00000-memory.dmp
                          Download

                          memory/4808-63-0x0000021B21200000-0x0000021B2120A000-memory.dmp
                          Download

                          memory/4808-59-0x0000021B211B0000-0x0000021B211BA000-memory.dmp
                          Download

                          memory/4808-58-0x0000021B211D0000-0x0000021B211EC000-memory.dmp
                          Download

                          memory/4808-60-0x0000021B21210000-0x0000021B2122A000-memory.dmp
                          Download

                          memory/4876-231-0x00000000029E0000-0x0000000002A3F000-memory.dmp
                          Download

                          memory/4876-236-0x00000000029E0000-0x0000000002A3F000-memory.dmp
                          Download

                          memory/4876-232-0x00000000029E0000-0x0000000002A3F000-memory.dmp
                          Download

                          memory/4876-229-0x00000000029E0000-0x0000000002A3F000-memory.dmp
                          Download

                          memory/4876-233-0x00000000029E0000-0x0000000002A3F000-memory.dmp
                          Download

                          memory/4876-230-0x00000000029E0000-0x0000000002A3F000-memory.dmp
                          Download

                          memory/4876-235-0x00000000029E0000-0x0000000002A3F000-memory.dmp
                          Download

                          memory/4876-237-0x00000000029E0000-0x0000000002A3F000-memory.dmp
                          Download

                          memory/4876-239-0x00000000029E0000-0x0000000002A3F000-memory.dmp
                          Download

                          memory/4876-240-0x00000000029E0000-0x0000000002A3F000-memory.dmp
                          Download