donutloader | 684835fc6ebdc28c2b322ae074d6468f2699e442c534713b4853b8a81c1d08dc

Analysis

user interaction
yes
max time kernel
299s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 10:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mod_analysis.exe
Size 1.1MB
Sample261102-mns1rsswg1
SHA256 684835fc6ebdc28c2b322ae074d6468f2699e442c534713b4853b8a81c1d08dc
MD5 86463240be2c8fb494dcc4da56949901
SHA1 af9e2ba6b5be26f0d703edb82e209e43014d7d07
SHA512 35ebf8aaa1a5d3515da50e28097759126e1d3cd95d581b089d8ee7a868ffb9e016aa8304b2dc310160b06a388c5e3bda0d6b319b0af7eb2f7b7670ed04cfe6cd
SSDEEP 24576:BwWOX6eCXt54Vfx/yGbMHa8iQeu2f2SZ/n7Yx:BbCc0x/x66J7
TLSH
T11545CF4423F19E02E379937F40B846C843F9F9056ECBEB12B2953DE39ADE344675A11A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution donutloader loader persistence privilege_escalation spyware stealer

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/3904-21-0x000001EFC9DE0000-0x000001EFC9FE6000-memory.dmp	family_donutloader

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2512	powershell.exe
1672	powershell.exe
5908	powershell.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Repair.lnk	mod_analysis.exe

Executes dropped EXE 2 IoCs

pid	Process
4408	CoreWorker_iOnudVlKYvGKJaI.exe
4316	CoreWorker_iOnudVlKYvGKJaI.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CoreWorker_iOnudVlKYvGKJaI = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_iOnudVlKYvGKJaI.exe"	CoreWorker_iOnudVlKYvGKJaI.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreWorker_iOnudVlKYvGKJaI = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_iOnudVlKYvGKJaI.exe"	mod_analysis.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreWorker_iOnudVlKYvGKJaI = "C:\\Users\\Admin\\AppData\\Local\\MpDefenderCoreFolder\\CoreWorker_iOnudVlKYvGKJaI.exe"	CoreWorker_iOnudVlKYvGKJaI.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
2	ip-api.com

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 4 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3492	cmd.exe
5276	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	mod_analysis.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	mod_analysis.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\Description\System\CentralProcessor\0	mod_analysis.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	mod_analysis.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe
3904	mod_analysis.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3904	mod_analysis.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeIncreaseQuotaPrivilege	1672	powershell.exe
Token: SeSecurityPrivilege	1672	powershell.exe
Token: SeTakeOwnershipPrivilege	1672	powershell.exe
Token: SeLoadDriverPrivilege	1672	powershell.exe
Token: SeSystemProfilePrivilege	1672	powershell.exe
Token: SeSystemtimePrivilege	1672	powershell.exe
Token: SeProfSingleProcessPrivilege	1672	powershell.exe
Token: SeIncBasePriorityPrivilege	1672	powershell.exe
Token: SeCreatePagefilePrivilege	1672	powershell.exe
Token: SeBackupPrivilege	1672	powershell.exe
Token: SeRestorePrivilege	1672	powershell.exe
Token: SeShutdownPrivilege	1672	powershell.exe
Token: SeDebugPrivilege	1672	powershell.exe
Token: SeSystemEnvironmentPrivilege	1672	powershell.exe
Token: SeRemoteShutdownPrivilege	1672	powershell.exe
Token: SeUndockPrivilege	1672	powershell.exe
Token: SeManageVolumePrivilege	1672	powershell.exe
Token: 33	1672	powershell.exe
Token: 34	1672	powershell.exe
Token: 35	1672	powershell.exe
Token: 36	1672	powershell.exe
Token: SeDebugPrivilege	4408	CoreWorker_iOnudVlKYvGKJaI.exe
Token: SeDebugPrivilege	4408	CoreWorker_iOnudVlKYvGKJaI.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	5908	powershell.exe
Token: SeIncreaseQuotaPrivilege	5908	powershell.exe
Token: SeSecurityPrivilege	5908	powershell.exe
Token: SeTakeOwnershipPrivilege	5908	powershell.exe
Token: SeLoadDriverPrivilege	5908	powershell.exe
Token: SeSystemProfilePrivilege	5908	powershell.exe
Token: SeSystemtimePrivilege	5908	powershell.exe
Token: SeProfSingleProcessPrivilege	5908	powershell.exe
Token: SeIncBasePriorityPrivilege	5908	powershell.exe
Token: SeCreatePagefilePrivilege	5908	powershell.exe
Token: SeBackupPrivilege	5908	powershell.exe
Token: SeRestorePrivilege	5908	powershell.exe
Token: SeShutdownPrivilege	5908	powershell.exe
Token: SeDebugPrivilege	5908	powershell.exe
Token: SeSystemEnvironmentPrivilege	5908	powershell.exe
Token: SeRemoteShutdownPrivilege	5908	powershell.exe
Token: SeUndockPrivilege	5908	powershell.exe
Token: SeManageVolumePrivilege	5908	powershell.exe
Token: 33	5908	powershell.exe
Token: 34	5908	powershell.exe
Token: 35	5908	powershell.exe
Token: 36	5908	powershell.exe
Token: SeIncreaseQuotaPrivilege	2512	powershell.exe
Token: SeSecurityPrivilege	2512	powershell.exe
Token: SeTakeOwnershipPrivilege	2512	powershell.exe
Token: SeLoadDriverPrivilege	2512	powershell.exe
Token: SeSystemProfilePrivilege	2512	powershell.exe
Token: SeSystemtimePrivilege	2512	powershell.exe
Token: SeProfSingleProcessPrivilege	2512	powershell.exe
Token: SeIncBasePriorityPrivilege	2512	powershell.exe
Token: SeCreatePagefilePrivilege	2512	powershell.exe
Token: SeBackupPrivilege	2512	powershell.exe
Token: SeRestorePrivilege	2512	powershell.exe
Token: SeShutdownPrivilege	2512	powershell.exe
Token: SeDebugPrivilege	2512	powershell.exe
Token: SeSystemEnvironmentPrivilege	2512	powershell.exe
Token: SeRemoteShutdownPrivilege	2512	powershell.exe
Token: SeUndockPrivilege	2512	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 4700	3904	mod_analysis.exe	89
PID 3904 wrote to memory of 4700	3904	mod_analysis.exe	89
PID 3904 wrote to memory of 3516	3904	mod_analysis.exe	90
PID 3904 wrote to memory of 3516	3904	mod_analysis.exe	90
PID 3904 wrote to memory of 3492	3904	mod_analysis.exe	94
PID 3492 wrote to memory of 1672	3492	cmd.exe	96
PID 3904 wrote to memory of 4408	3904	mod_analysis.exe	98
PID 4408 wrote to memory of 2512	4408	CoreWorker_iOnudVlKYvGKJaI.exe	99
PID 4408 wrote to memory of 5276	4408	CoreWorker_iOnudVlKYvGKJaI.exe	101
PID 5276 wrote to memory of 5908	5276	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\mod_analysis.exe
"C:\Users\Admin\AppData\Local\Temp\mod_analysis.exe"
1⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
  2⤵
  PID:4700
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:3516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3492
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -C "Add-MpPreference -ExclusionExtension '.exe' -EA 0"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:1672
- C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_iOnudVlKYvGKJaI.exe
  "C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_iOnudVlKYvGKJaI.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -Command " $action = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_iOnudVlKYvGKJaI.exe' $trigger = New-ScheduledTaskTrigger -AtLogOn Register-ScheduledTask -Action $action -Trigger $trigger -TaskName 'CoreWorker_iOnudVlKYvGKJaI-6823' -RunLevel Highest "
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious use of AdjustPrivilegeToken
    PID:2512
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5276
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\MpDefenderCoreFolder'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:5908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1368

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3216

C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_iOnudVlKYvGKJaI.exe
C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_iOnudVlKYvGKJaI.exe
1⤵
- Executes dropped EXE
PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Debugger Evasion

T1622

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d1bc6f450f7ee5f1ec28dcfd2dc8291acddd0ea291aca5e245471d684847f39d
MD5 adea5c1cafdd9f8cc57121442eaf37fb
SHA1 a270ee9156b0d3935b318dbf8be4cce24fc909a8
SHA512 b699052bb8c0b060207135930b60562ad3957e9583213836946322f680ae411d271d882d95bd976724203a48cdcd2e975753f1475634373f3c3ab8f1b5fe70b9
TLSH
T120216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB7B84E655A43F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

CoreWorker_iOnudVlKYvGKJaI.exe

Path C:\Users\Admin\AppData\Local\MpDefenderCoreFolder\CoreWorker_iOnudVlKYvGKJaI.exe
Size 13KB
SHA256 7a1a72c9ded2410b1dbadf133aa6636e67059a6c7e9eca58f1c860e13d36f99c
MD5 948fb63b85af2b99ffabcfdf170555a5
SHA1 eb9e2567fcf492d3cd49a6a1d52a67a82e178e43
SHA512 68f62e9b026a316b3cad7c3f50d95db742d62906303fe2ed27a66c4605c5dccf5148f8a8c17a0a533446e09f028add1c086db245ae04384e56ad9b874edf34a7
SSDEEP 384:FrEJwUftgSiowLVrmbQSgxLiRllEFDx3nW7v:FIwajBbWxGRlkh4
TLSH
T17B52DA0477E08235E97A0B75AEB356041A33FB624935CE5E148C528B0B67781ADE2F75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_fjtavioy.2h2.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fjtavioy.2h2.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1672-42-0x00000196B4610000-0x00000196B461A000-memory.dmp

Download

memory/1672-41-0x00000196B4850000-0x00000196B4902000-memory.dmp

Download

memory/1672-40-0x00000196B4830000-0x00000196B484E000-memory.dmp

Download

memory/1672-37-0x000001969C3F0000-0x000001969C412000-memory.dmp

Download

memory/2512-72-0x00000278A3510000-0x00000278A352E000-memory.dmp

Download

memory/2512-69-0x00000278A31D0000-0x00000278A3282000-memory.dmp

Download

memory/3516-30-0x0000024B55CD0000-0x0000024B55CE0000-memory.dmp

Download

memory/3904-11-0x000001EFCA1E0000-0x000001EFCA708000-memory.dmp

Download

memory/3904-43-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-13-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-14-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-15-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-16-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-17-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-18-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-19-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-20-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-21-0x000001EFC9DE0000-0x000001EFC9FE6000-memory.dmp

Download

memory/3904-22-0x000001EFCAB20000-0x000001EFCAD26000-memory.dmp

Download

memory/3904-24-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-25-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-26-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-23-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-28-0x000001EFC9A10000-0x000001EFC9A22000-memory.dmp

Download

memory/3904-1-0x00007FFF70B7F000-0x00007FFF70B80000-memory.dmp

Download

memory/3904-12-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-2-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-32-0x000001EFC9A80000-0x000001EFC9AD0000-memory.dmp

Download

memory/3904-33-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-34-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-10-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-9-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-8-0x000001EFC9820000-0x000001EFC9896000-memory.dmp

Download

memory/3904-7-0x000001EFC9AE0000-0x000001EFC9CA2000-memory.dmp

Download

memory/3904-6-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-0-0x000001EFAF1E0000-0x000001EFAF306000-memory.dmp

Download

memory/3904-45-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-46-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-5-0x000001EFAF750000-0x000001EFAF751000-memory.dmp

Download

memory/3904-3-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-60-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/3904-4-0x00007FFF709F0000-0x00007FFF71394000-memory.dmp

Download

memory/4408-59-0x0000017D6F350000-0x0000017D6F35A000-memory.dmp

Download

memory/4700-31-0x000001F065F00000-0x000001F065F1E000-memory.dmp

Download

memory/4700-29-0x000001F065E90000-0x000001F065EA0000-memory.dmp

Download