donutloader | d8ae95705379f6f0233c294d5d9d841ebccb6dae75736aadd0ff25d6d350b9ed

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/02/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0B82B7C4AD21F54E62C93B8976E62726.exe
Size 2.1MB
Sample260228-rd2blsat4e
SHA256 d8ae95705379f6f0233c294d5d9d841ebccb6dae75736aadd0ff25d6d350b9ed
MD5 0b82b7c4ad21f54e62c93b8976e62726
SHA1 027356938e96642c6bbde4c24b99bf78db6052e7
SHA512 17c32b7b1a99b322eef7b95d119a6b91e38d1bf2dcbf54ee187063ae86e93ddd272ac302c15969181550ee6f8d20037775b2cea790fb4882f38f06c4048cd00d
SSDEEP 49152:IAR6pHImCXi45lSevpEiegzoQ49aXZmMAGWaoDuNvaUtDaXmpIW51I:IwI7Wl5Yei1LQ49unkuwUtYq51I
TLSH
T100A50133B5E28533EAB640B02E541B469FBFE6320438CC5B97D86D496764DC3E61A393
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor discovery donutloader gh0strat purplefox valleyrat_s2 loader persistence ransomware rat rootkit trojan upx

Malware Config

Extracted

Family

valleyrat_s2

Version

108.187.43.3:1799
108.187.43.3:443
108.187.43.3:80

Attributes

campaign_date
2026. 2.14

Signatures

Detect PurpleFox Rootkit 2 IoCs

Detect PurpleFox Rootkit.

rootkit

resource	yara_rule
behavioral1/memory/3920-13-0x0000000010000000-0x000000001019F000-memory.dmp	purplefox_rootkit
behavioral1/memory/6108-23-0x0000000010000000-0x000000001019F000-memory.dmp	purplefox_rootkit

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral1/memory/5672-49-0x000001CC3E0E0000-0x000001CC3E109000-memory.dmp	family_donutloader

Detects ValleyRAT payload 9 IoCs

resource	yara_rule
behavioral1/memory/5672-52-0x000001CC40CD0000-0x000001CC40D2B000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/5672-53-0x000001CC40CD0000-0x000001CC40D2B000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/5672-54-0x000001CC40CD0000-0x000001CC40D2B000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/5672-55-0x000001CC40CD0000-0x000001CC40D2B000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/5672-56-0x000001CC40CD0000-0x000001CC40D2B000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/5672-57-0x000001CC40CD0000-0x000001CC40D2B000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/5672-71-0x000001CC40CD0000-0x000001CC40D2B000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/5672-73-0x000001CC40CD0000-0x000001CC40D2B000-memory.dmp	family_valleyrat_stage_2_v2
behavioral1/memory/5672-72-0x000001CC40CD0000-0x000001CC40D2B000-memory.dmp	family_valleyrat_stage_2_v2

DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Donutloader family
donutloader

Gh0st RAT payload 2 IoCs

resource	yara_rule
behavioral1/memory/3920-13-0x0000000010000000-0x000000001019F000-memory.dmp	family_gh0strat
behavioral1/memory/6108-23-0x0000000010000000-0x000000001019F000-memory.dmp	family_gh0strat

Gh0strat
Gh0st RAT is a remote access tool (RAT) with its source code public and it has been used by multiple Chinese groups.
rat gh0strat
Gh0strat family
gh0strat
PurpleFox
PurpleFox is an exploit kit used to distribute other malware families and first seen in 2018.
rootkit trojan purplefox
Purplefox family
purplefox
ValleyRat
ValleyRat stage2 is a backdoor written in C++.
backdoor valleyrat_s2
Valleyrat_s2 family
valleyrat_s2

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\QAssist.sys	Gwogwo.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QAssist\ImagePath = "system32\\DRIVERS\\QAssist.sys"	Gwogwo.exe

Executes dropped EXE 5 IoCs

pid	Process
2292	sg.tmp
3920	Setup3221.exe
6108	Gwogwo.exe
5764	Gwogwo.exe
5672	MA.exe

Enumerates connected drives 3 TTPs 44 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	Gwogwo.exe
File opened (read-only)	\??\L:	Gwogwo.exe
File opened (read-only)	\??\M:	Gwogwo.exe
File opened (read-only)	\??\H:	MA.exe
File opened (read-only)	\??\I:	MA.exe
File opened (read-only)	\??\Q:	MA.exe
File opened (read-only)	\??\R:	MA.exe
File opened (read-only)	\??\B:	Gwogwo.exe
File opened (read-only)	\??\E:	Gwogwo.exe
File opened (read-only)	\??\V:	Gwogwo.exe
File opened (read-only)	\??\W:	Gwogwo.exe
File opened (read-only)	\??\B:	MA.exe
File opened (read-only)	\??\E:	MA.exe
File opened (read-only)	\??\H:	Gwogwo.exe
File opened (read-only)	\??\R:	Gwogwo.exe
File opened (read-only)	\??\X:	Gwogwo.exe
File opened (read-only)	\??\Z:	Gwogwo.exe
File opened (read-only)	\??\G:	MA.exe
File opened (read-only)	\??\O:	MA.exe
File opened (read-only)	\??\P:	MA.exe
File opened (read-only)	\??\Y:	MA.exe
File opened (read-only)	\??\P:	Gwogwo.exe
File opened (read-only)	\??\S:	Gwogwo.exe
File opened (read-only)	\??\T:	Gwogwo.exe
File opened (read-only)	\??\J:	MA.exe
File opened (read-only)	\??\K:	MA.exe
File opened (read-only)	\??\M:	MA.exe
File opened (read-only)	\??\N:	MA.exe
File opened (read-only)	\??\Z:	MA.exe
File opened (read-only)	\??\I:	Gwogwo.exe
File opened (read-only)	\??\J:	Gwogwo.exe
File opened (read-only)	\??\Y:	Gwogwo.exe
File opened (read-only)	\??\Q:	Gwogwo.exe
File opened (read-only)	\??\U:	Gwogwo.exe
File opened (read-only)	\??\L:	MA.exe
File opened (read-only)	\??\T:	MA.exe
File opened (read-only)	\??\U:	MA.exe
File opened (read-only)	\??\X:	MA.exe
File opened (read-only)	\??\K:	Gwogwo.exe
File opened (read-only)	\??\N:	Gwogwo.exe
File opened (read-only)	\??\O:	Gwogwo.exe
File opened (read-only)	\??\S:	MA.exe
File opened (read-only)	\??\V:	MA.exe
File opened (read-only)	\??\W:	MA.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Gwogwo.exe	Setup3221.exe
File opened for modification	C:\Windows\SysWOW64\Gwogwo.exe	Setup3221.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3792-0-0x0000000000400000-0x0000000000569000-memory.dmp	upx
behavioral1/memory/3792-58-0x0000000000400000-0x0000000000569000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0B82B7C4AD21F54E62C93B8976E62726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup3221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gwogwo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gwogwo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5012	cmd.exe
3064	PING.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Gwogwo.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Gwogwo.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum	Gwogwo.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	Gwogwo.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Gwogwo.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	Gwogwo.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7"	Gwogwo.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3064	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe
5764	Gwogwo.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
5764	Gwogwo.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeBackupPrivilege	3792	0B82B7C4AD21F54E62C93B8976E62726.exe
Token: SeRestorePrivilege	3792	0B82B7C4AD21F54E62C93B8976E62726.exe
Token: 33	3792	0B82B7C4AD21F54E62C93B8976E62726.exe
Token: SeIncBasePriorityPrivilege	3792	0B82B7C4AD21F54E62C93B8976E62726.exe
Token: 33	3792	0B82B7C4AD21F54E62C93B8976E62726.exe
Token: SeIncBasePriorityPrivilege	3792	0B82B7C4AD21F54E62C93B8976E62726.exe
Token: 33	3792	0B82B7C4AD21F54E62C93B8976E62726.exe
Token: SeIncBasePriorityPrivilege	3792	0B82B7C4AD21F54E62C93B8976E62726.exe
Token: SeRestorePrivilege	2292	sg.tmp
Token: 35	2292	sg.tmp
Token: SeSecurityPrivilege	2292	sg.tmp
Token: SeSecurityPrivilege	2292	sg.tmp
Token: 33	3792	0B82B7C4AD21F54E62C93B8976E62726.exe
Token: SeIncBasePriorityPrivilege	3792	0B82B7C4AD21F54E62C93B8976E62726.exe
Token: SeIncBasePriorityPrivilege	3920	Setup3221.exe
Token: 33	3792	0B82B7C4AD21F54E62C93B8976E62726.exe
Token: SeIncBasePriorityPrivilege	3792	0B82B7C4AD21F54E62C93B8976E62726.exe
Token: SeLoadDriverPrivilege	5764	Gwogwo.exe
Token: 33	5764	Gwogwo.exe
Token: SeIncBasePriorityPrivilege	5764	Gwogwo.exe
Token: 33	5764	Gwogwo.exe
Token: SeIncBasePriorityPrivilege	5764	Gwogwo.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5672	MA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 5200	3792	0B82B7C4AD21F54E62C93B8976E62726.exe	86
PID 3792 wrote to memory of 2292	3792	0B82B7C4AD21F54E62C93B8976E62726.exe	89
PID 3792 wrote to memory of 3920	3792	0B82B7C4AD21F54E62C93B8976E62726.exe	93
PID 6108 wrote to memory of 5764	6108	Gwogwo.exe	95
PID 3920 wrote to memory of 5012	3920	Setup3221.exe	96
PID 3792 wrote to memory of 5672	3792	0B82B7C4AD21F54E62C93B8976E62726.exe	97
PID 5012 wrote to memory of 3064	5012	cmd.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\0B82B7C4AD21F54E62C93B8976E62726.exe
"C:\Users\Admin\AppData\Local\Temp\0B82B7C4AD21F54E62C93B8976E62726.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Windows\SYSTEM32\cmd.exe
  cmd.exe /c set
  2⤵
  PID:5200
- C:\Users\Admin\AppData\Local\Temp\~9056298447924285755~\sg.tmp
  7zG_exe x "C:\Users\Admin\AppData\Local\Temp\0B82B7C4AD21F54E62C93B8976E62726.exe" -y -aoa -o"C:\Users\Admin\AppData\Local\Temp\~8306416172488408933"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2292
- C:\Users\Admin\AppData\Local\Temp\~8306416172488408933\Setup3221.exe
  "C:\Users\Admin\AppData\Local\Temp\~8306416172488408933\Setup3221.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3920
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\~83064~1\SETUP3~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Windows\SysWOW64\PING.EXE
      ping -n 2 127.0.0.1
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3064
- C:\Users\Admin\AppData\Local\Temp\~8306416172488408933\MA.exe
  "C:\Users\Admin\AppData\Local\Temp\~8306416172488408933\MA.exe"
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:5672

C:\Windows\SysWOW64\Gwogwo.exe
C:\Windows\SysWOW64\Gwogwo.exe -auto
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6108
- C:\Windows\SysWOW64\Gwogwo.exe
  C:\Windows\SysWOW64\Gwogwo.exe -acsi
  2⤵
  - Drops file in Drivers directory
  - Sets service image path in registry
  - Executes dropped EXE
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: LoadsDriver
  - Suspicious use of AdjustPrivilegeToken
  PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

MA.exe

Path C:\Users\Admin\AppData\Local\Temp\~8306416172488408933\MA.exe
Size 446KB
SHA256 b3da593a7219b45deddd92b7b9ac337d311bbe16bbb38aef9a1d6160aa24d136
MD5 abb2c7862f7a489f8b767a195eb84f43
SHA1 57023e87c06f11ec84a1c3e727ca8492b2f2ca3f
SHA512 9f014cb2cba38511a1bd0af266efe0c5936e87be12608e15d9aa62e4a4bda9115c3c37095ccaba01f3128517940be884190a723e5e736d8f387ab701a6f986d1
SSDEEP 6144:gsQ946uFaV+ziqt7uz/inNHh7CrV4q6YKF1XbtLws:gsO4sV+Rt7K/kHVCNJKrxM
TLSH
T1B5A4C0DEE2AA10E1CC1626F998140BC79B3145325774055F237AAD950F375FACC2EFA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup3221.exe

Path C:\Users\Admin\AppData\Local\Temp\~8306416172488408933\Setup3221.exe
Size 1.4MB
SHA256 84582ae3e4944b8697b498c8302ae5d334d18907bc198714b7d149ec5e88dec2
MD5 77a805f78225bad037c269f28551c3b6
SHA1 1296b302d702e2d7547a327c1059cd9f8a717189
SHA512 0086606708e5df07432ea3806417abb54569db825ad6f88e2d2984515fa77dfc805751977d01d2e1829ac2b06133fa6d02f49eac442acf963cec82748806b762
SSDEEP 24576:F39WaOyHutimZ9VSly2hVvHW6qMnSbTBBhBMN:598HPkVOBTK
TLSH
T1D665AE591BA74266DB557779C8A6A6A419190F431F28C0B21E304E1EBD2334FFC23EBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sg.tmp

Path C:\Users\Admin\AppData\Local\Temp\~9056298447924285755~\sg.tmp
Size 715KB
SHA256 4cc32d00338fc7b206a7c052297acf9ac304ae7de9d61a2475a116959c1524fc
MD5 7c4718943bd3f66ebdb47ccca72c7b1e
SHA1 f9edfaa7adb8fa528b2e61b2b251f18da10a6969
SHA512 e18c40d646fa4948f90f7471da55489df431f255041ebb6dcef86346f91078c9b27894e27216a4b2fe2a1c5e501c7953c77893cf696930123d28a322d49e1516
SSDEEP 12288:fDGME0uBHVw8VOa/iJ9x1mJhXTUOr/swII0urngQfmsa9mn+WEqdxaxH7B:fD2lHV4a/G9x1UhjU+EwhrrngwmsemZe
TLSH
T131F49E223BF6C1BBD24201318A1CABF590F5F7590B3059C363908F6D6B399D5D63AA1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3792-0-0x0000000000400000-0x0000000000569000-memory.dmp

Download

memory/3792-58-0x0000000000400000-0x0000000000569000-memory.dmp

Download

memory/3920-13-0x0000000010000000-0x000000001019F000-memory.dmp

Download

memory/5672-54-0x000001CC40CD0000-0x000001CC40D2B000-memory.dmp

Download

memory/5672-57-0x000001CC40CD0000-0x000001CC40D2B000-memory.dmp

Download

memory/5672-52-0x000001CC40CD0000-0x000001CC40D2B000-memory.dmp

Download

memory/5672-53-0x000001CC40CD0000-0x000001CC40D2B000-memory.dmp

Download

memory/5672-49-0x000001CC3E0E0000-0x000001CC3E109000-memory.dmp

Download

memory/5672-55-0x000001CC40CD0000-0x000001CC40D2B000-memory.dmp

Download

memory/5672-56-0x000001CC40CD0000-0x000001CC40D2B000-memory.dmp

Download

memory/5672-51-0x000001CC3F230000-0x000001CC3F259000-memory.dmp

Download

memory/5672-72-0x000001CC40CD0000-0x000001CC40D2B000-memory.dmp

Download

memory/5672-59-0x000001CC3F1C0000-0x000001CC3F1F0000-memory.dmp

Download

memory/5672-61-0x000001CC3F1C0000-0x000001CC3F1F0000-memory.dmp

Download

memory/5672-71-0x000001CC40CD0000-0x000001CC40D2B000-memory.dmp

Download

memory/5672-73-0x000001CC40CD0000-0x000001CC40D2B000-memory.dmp

Download

memory/6108-23-0x0000000010000000-0x000000001019F000-memory.dmp

Download