donutloader | fa298d04439c2a2caf87bd421c74f43bacd07d639f0f57d6462282531a8e8f1e

Analysis

max time kernel
149s
max time network
148s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
17/05/2026, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Delta.exe
Size 21.3MB
Sample260517-wbbqdsft9k
SHA256 fa298d04439c2a2caf87bd421c74f43bacd07d639f0f57d6462282531a8e8f1e
MD5 11d332005dc70a95b9772018d624d682
SHA1 dbf0622d51af249220800a591cf879e2b82ec3e1
SHA512 0e3d188f5d7e7a3977381beff91c1c29642f2058f16e90f149e2044709e6a5e67383a29b62dc351686e76535765666bbbcdbe5853afe379db6ac257fbc266004
SSDEEP 24576:DlRpjzvKWCuEjedjMdsEQ+rTyy7uJ/VZssbXcmc3Gbr3NH:npjeWLtO9Jyi4ZTbMlWbrdH
TLSH
T16A279E0237FEB09EEBABC7B4956556419621FC770E51808E31CD149B0F9B9407FBC2AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution donutloader loader persistence spyware stealer

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 2 IoCs

loader

resource	yara_rule
behavioral2/memory/4568-17-0x0000026AED600000-0x0000026AED7F2000-memory.dmp	family_donutloader
behavioral2/memory/4568-18-0x0000026AD28C0000-0x0000026AD28D0000-memory.dmp	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2088	powershell.exe
4776	powershell.exe
1216	powershell.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Repair.lnk	c7613629e194.exe

Executes dropped EXE 3 IoCs

pid	Process
4568	c7613629e194.exe
2972	CoreWorker_GOBxHFpNYcKWOHH.exe
4400	CoreWorker_GOBxHFpNYcKWOHH.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreWorker_GOBxHFpNYcKWOHH = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_GOBxHFpNYcKWOHH.exe"	c7613629e194.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreWorker_GOBxHFpNYcKWOHH = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_GOBxHFpNYcKWOHH.exe"	CoreWorker_GOBxHFpNYcKWOHH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoreWorker_GOBxHFpNYcKWOHH = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_GOBxHFpNYcKWOHH.exe"	CoreWorker_GOBxHFpNYcKWOHH.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	c7613629e194.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	c7613629e194.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe
4568	c7613629e194.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4568	c7613629e194.exe
Token: SeDebugPrivilege	4568	c7613629e194.exe
Token: SeDebugPrivilege	4776	powershell.exe
Token: SeDebugPrivilege	2972	CoreWorker_GOBxHFpNYcKWOHH.exe
Token: SeDebugPrivilege	2972	CoreWorker_GOBxHFpNYcKWOHH.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeIncreaseQuotaPrivilege	1216	powershell.exe
Token: SeSecurityPrivilege	1216	powershell.exe
Token: SeTakeOwnershipPrivilege	1216	powershell.exe
Token: SeLoadDriverPrivilege	1216	powershell.exe
Token: SeSystemProfilePrivilege	1216	powershell.exe
Token: SeSystemtimePrivilege	1216	powershell.exe
Token: SeProfSingleProcessPrivilege	1216	powershell.exe
Token: SeIncBasePriorityPrivilege	1216	powershell.exe
Token: SeCreatePagefilePrivilege	1216	powershell.exe
Token: SeBackupPrivilege	1216	powershell.exe
Token: SeRestorePrivilege	1216	powershell.exe
Token: SeShutdownPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeSystemEnvironmentPrivilege	1216	powershell.exe
Token: SeRemoteShutdownPrivilege	1216	powershell.exe
Token: SeUndockPrivilege	1216	powershell.exe
Token: SeManageVolumePrivilege	1216	powershell.exe
Token: 33	1216	powershell.exe
Token: 34	1216	powershell.exe
Token: 35	1216	powershell.exe
Token: 36	1216	powershell.exe
Token: SeIncreaseQuotaPrivilege	1216	powershell.exe
Token: SeSecurityPrivilege	1216	powershell.exe
Token: SeTakeOwnershipPrivilege	1216	powershell.exe
Token: SeLoadDriverPrivilege	1216	powershell.exe
Token: SeSystemProfilePrivilege	1216	powershell.exe
Token: SeSystemtimePrivilege	1216	powershell.exe
Token: SeProfSingleProcessPrivilege	1216	powershell.exe
Token: SeIncBasePriorityPrivilege	1216	powershell.exe
Token: SeCreatePagefilePrivilege	1216	powershell.exe
Token: SeBackupPrivilege	1216	powershell.exe
Token: SeRestorePrivilege	1216	powershell.exe
Token: SeShutdownPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeSystemEnvironmentPrivilege	1216	powershell.exe
Token: SeRemoteShutdownPrivilege	1216	powershell.exe
Token: SeUndockPrivilege	1216	powershell.exe
Token: SeManageVolumePrivilege	1216	powershell.exe
Token: 33	1216	powershell.exe
Token: 34	1216	powershell.exe
Token: 35	1216	powershell.exe
Token: 36	1216	powershell.exe
Token: SeIncreaseQuotaPrivilege	1216	powershell.exe
Token: SeSecurityPrivilege	1216	powershell.exe
Token: SeTakeOwnershipPrivilege	1216	powershell.exe
Token: SeLoadDriverPrivilege	1216	powershell.exe
Token: SeSystemProfilePrivilege	1216	powershell.exe
Token: SeSystemtimePrivilege	1216	powershell.exe
Token: SeProfSingleProcessPrivilege	1216	powershell.exe
Token: SeIncBasePriorityPrivilege	1216	powershell.exe
Token: SeCreatePagefilePrivilege	1216	powershell.exe
Token: SeBackupPrivilege	1216	powershell.exe
Token: SeRestorePrivilege	1216	powershell.exe
Token: SeShutdownPrivilege	1216	powershell.exe
Token: SeDebugPrivilege	1216	powershell.exe
Token: SeSystemEnvironmentPrivilege	1216	powershell.exe
Token: SeRemoteShutdownPrivilege	1216	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 4568	1860	Delta.exe	80
PID 4568 wrote to memory of 2940	4568	c7613629e194.exe	82
PID 4568 wrote to memory of 3468	4568	c7613629e194.exe	83
PID 4568 wrote to memory of 2940	4568	c7613629e194.exe	82
PID 4568 wrote to memory of 3468	4568	c7613629e194.exe	83
PID 4568 wrote to memory of 4800	4568	c7613629e194.exe	86
PID 4800 wrote to memory of 4776	4800	cmd.exe	88
PID 4568 wrote to memory of 2972	4568	c7613629e194.exe	89
PID 2972 wrote to memory of 1216	2972	CoreWorker_GOBxHFpNYcKWOHH.exe	90
PID 2972 wrote to memory of 2368	2972	CoreWorker_GOBxHFpNYcKWOHH.exe	92
PID 2368 wrote to memory of 2088	2368	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\Delta.exe
"C:\Users\Admin\AppData\Local\Temp\Delta.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Users\Admin\AppData\Local\Temp\c7613629e194.exe
  "C:\Users\Admin\AppData\Local\Temp\c7613629e194.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
    3⤵
    PID:2940
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:3468
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4776
- - C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_GOBxHFpNYcKWOHH.exe
    "C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_GOBxHFpNYcKWOHH.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2972
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_GOBxHFpNYcKWOHH.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'CoreWorker_GOBxHFpNYcKWOHH-9637' -RunLevel Highest "
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1216
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2368
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious use of AdjustPrivilegeToken
        
        PID:2088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3900

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:900

C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_GOBxHFpNYcKWOHH.exe
C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_GOBxHFpNYcKWOHH.exe
1⤵
- Executes dropped EXE
PID:4400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 4KB
SHA256 e27390d57580e3dfba07bec3d8e430203bbc91e90f6937079b3fd52abc721bd4
MD5 dbbd2d4458d7e8094846420da595dfc3
SHA1 267cb47b904f14a519d2bd73abfdb30e1a06e1a6
SHA512 480e7ca865b811f79f35fcfe7a9ac0280b48d1f9459873d18f000db55c72d53345cf3a10075c1ac407439545f699ce2a7bef38b00b4e19439edf384b00045531
SSDEEP 96:iq4uYqGEo9xx+incqKXq3qotzYNYr7aqCiNLm7RIz+cBPzQh0nRAy6FcxZcosQSm:iq4uYqGEUdncqKXq3qotzYuWq2Iz+wx
TLSH
T11D91EE323375E0D5C8263F07192C19C463AF439AEA54AF48B258620EED2714BDF122F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 813ab457b6b57b182d9d3c806a53c598121666942e76ed962b142c00c0fc1188
MD5 fec200e29abbd2da2cd108c79021d78f
SHA1 b4f1ccc73015cc8ddba58a8329ae1cd8a28cc682
SHA512 9de2ffee24029a035952391f00e1ad9c800352639f2051897ffdb3b131a949686c59530fa555d6d4e1aad6a01f2a72010089064f16caf8da31ac8ef52fdc8c3e
TLSH
T1D0216533B3ECC125C8D9117A208CAD00B2B6C3C7449E8F8B7A84C619957F9DADB641A4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 b79f569e6c453b33139dcd90442a80e59ac882a1e272a8e4a322d295bfac3ab0
MD5 e60feda9a7e775a7d83cc6ec30a00f68
SHA1 b258b886f3cba5a97922f2695ebeaedafe3638ef
SHA512 51dae2882602a7ef7b3e43cc8745cc6fd974beae26a17730c928d4e82dc19dbb66287d9431cc6bd1990a7278c546cd3f9a51eeb6debd73eacf2803ee303c70e2
TLSH
T153218633B7ACC234C8D911BA208CAD01B2B5C3C7449ECE8B7B84C508A57F99ADB645E4
MD5 SHA1 SHA512 TLSH

Submit Download

CoreWorker_GOBxHFpNYcKWOHH.exe

Path C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_GOBxHFpNYcKWOHH.exe
Size 13KB
SHA256 27680f82001ad52345c3eb9feb15f243141955204d332f8c4715008a4ec53bc9
MD5 799ca1dba3b07f476998d53b5a7a286c
SHA1 6887ef2a385e1bfa7bf45ead268ead44a2c60bb2
SHA512 b858c2afe889657c43090336a68103360361994b5e0b1d21401620dda657a808f13b81f1ef7e5d4f7fe808dc07ad58be9e2f3f1ff5f398ca9d95ef14c90788b7
SSDEEP 192:o3ED4poDaVm2iJJdMBizTcPKw+rmbQSaZxGKxOkhE9MVEMKRDTQ7W7vm:uEyVmciw+rmbQSgxLQR9cEMKxgW7v
TLSH
T1D952D804A7E08139D6BA0B75DEF265105A33F7564932CE1F248C928B5B27380EDE2F66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_cbn1nwge.sdb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cbn1nwge.sdb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

c7613629e194.exe

Path C:\Users\Admin\AppData\Local\Temp\c7613629e194.exe
Size 1.1MB
SHA256 c6041ad628f3c63bb31ea773f6012d9820cbacba3129cc94ba73f71d6ba8d0c3
MD5 4ab4436b42b082ba7030c9c0d3180cca
SHA1 55515c402b106049da7d8eb9b8acb51a73162286
SHA512 1459149656121bedf44d576bd1630c8bb3d1afbe70bf1283e5e91e5ad14a5d3ca2d59bb13be813a2439a4ce5ee3832e3cd709d0d6ca8925999b1f92032c3f09e
SSDEEP 24576:LgAoOX6eCO1h9sfCIui4qE//Pg5nMaMHfrT4v4KX:UAoC+fGqE4jmf4
TLSH
T1AE35D0162BA5DD41D2AE63B940640BC853FD8C15AE8AD7A6A3D03CF35ECF341A72605F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2088-98-0x00000232731E0000-0x0000023273293000-memory.dmp

Download

memory/2940-27-0x000001A4EFB20000-0x000001A4EFB3E000-memory.dmp

Download

memory/2940-25-0x000001A4D71F0000-0x000001A4D7200000-memory.dmp

Download

memory/2972-77-0x000001B9C7E40000-0x000001B9C7E4A000-memory.dmp

Download

memory/3468-26-0x0000025CDC180000-0x0000025CDC190000-memory.dmp

Download

memory/4568-32-0x0000026AD28C0000-0x0000026AD28D0000-memory.dmp

Download

memory/4568-34-0x0000026AD28C0000-0x0000026AD28D0000-memory.dmp

Download

memory/4568-24-0x0000026AD2960000-0x0000026AD2972000-memory.dmp

Download

memory/4568-23-0x0000026AD28C0000-0x0000026AD28D0000-memory.dmp

Download

memory/4568-21-0x0000026AD28C0000-0x0000026AD28D0000-memory.dmp

Download

memory/4568-19-0x0000026AEE260000-0x0000026AEE452000-memory.dmp

Download

memory/4568-18-0x0000026AD28C0000-0x0000026AD28D0000-memory.dmp

Download

memory/4568-30-0x0000026AED510000-0x0000026AED560000-memory.dmp

Download

memory/4568-31-0x0000026AD28C0000-0x0000026AD28D0000-memory.dmp

Download

memory/4568-17-0x0000026AED600000-0x0000026AED7F2000-memory.dmp

Download

memory/4568-33-0x0000026AD28C0000-0x0000026AD28D0000-memory.dmp

Download

memory/4568-15-0x0000026AD28C0000-0x0000026AD28D0000-memory.dmp

Download

memory/4568-35-0x0000026AD28C0000-0x0000026AD28D0000-memory.dmp

Download

memory/4568-36-0x0000026AD28C0000-0x0000026AD28D0000-memory.dmp

Download

memory/4568-16-0x0000026AEDB30000-0x0000026AEE058000-memory.dmp

Download

memory/4568-20-0x0000026AD28C0000-0x0000026AD28D0000-memory.dmp

Download

memory/4568-10-0x0000026AD0A10000-0x0000026AD0B24000-memory.dmp

Download

memory/4568-11-0x0000026AD28C0000-0x0000026AD28D0000-memory.dmp

Download

memory/4568-12-0x0000026AD10D0000-0x0000026AD10D1000-memory.dmp

Download

memory/4568-13-0x0000026AEC850000-0x0000026AECA12000-memory.dmp

Download

memory/4568-14-0x0000026AEC680000-0x0000026AEC6F6000-memory.dmp

Download

memory/4776-37-0x0000010BFBD40000-0x0000010BFBD62000-memory.dmp

Download

memory/4776-56-0x0000010BFC220000-0x0000010BFC228000-memory.dmp

Download

memory/4776-57-0x0000010BFC4A0000-0x0000010BFC4A6000-memory.dmp

Download

memory/4776-58-0x0000010BFC4B0000-0x0000010BFC4BA000-memory.dmp

Download

memory/4776-55-0x0000010BFC4C0000-0x0000010BFC4DA000-memory.dmp

Download

memory/4776-54-0x0000010BFC210000-0x0000010BFC21A000-memory.dmp

Download

memory/4776-53-0x0000010BFC480000-0x0000010BFC49C000-memory.dmp

Download

memory/4776-52-0x0000010BFBF30000-0x0000010BFBF3A000-memory.dmp

Download

memory/4776-51-0x0000010BFC150000-0x0000010BFC203000-memory.dmp

Download

memory/4776-50-0x0000010BFBF10000-0x0000010BFBF2C000-memory.dmp

Download