donutloader | 047a01e176919ef652998a9e84bb886fd42cb666540bd63c4e07a31c988696cb

Analysis

max time kernel
9s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/11/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
svchost.exe
Size 1.1MB
Sample261102-tmvxasdv9m
SHA256 047a01e176919ef652998a9e84bb886fd42cb666540bd63c4e07a31c988696cb
MD5 88820e7795c7979689895de5c38dd65c
SHA1 b539ada032cb04cef0b1a93a201da1e5cb6fb4d5
SHA512 3804fb1010da368518bd26aad5a5a98fa0bad236d0175a0efa6558c2916625b81410970f3cd7bcb8cba7b2df3ed5a9688a40cceca51edd25904290a4c945a169
SSDEEP 24576:D+o11C2Fe8IQXNK9eHzDQ92glXI/WiUXDNVGwiKhZdXbn:yoa2Q8/NKQHzssGX4WiUXDNVG5KTdr
TLSH
T1A33502A3F6A000FAD46681748D635B06B7B6F07A0320A7FF0B94595C7F637B05D29B91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion donutloader loader persistence privilege_escalation

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 3 IoCs

loader

resource	yara_rule
behavioral3/memory/1396-0-0x00000200B9350000-0x00000200B9472000-memory.dmp	family_donutloader
behavioral3/memory/1396-11-0x00000200D5C80000-0x00000200D5D70000-memory.dmp	family_donutloader
behavioral3/memory/3184-13-0x0000000004950000-0x0000000004A39000-memory.dmp	family_donutloader

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk	Explorer.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Explorer.lnk	Explorer.EXE

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4052	2dbxlttx.zoq.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1396	svchost.exe
1396	svchost.exe
4052	2dbxlttx.zoq.exe
4052	2dbxlttx.zoq.exe
4052	2dbxlttx.zoq.exe
4052	2dbxlttx.zoq.exe
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
4052	2dbxlttx.zoq.exe
4052	2dbxlttx.zoq.exe
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
4052	2dbxlttx.zoq.exe
4052	2dbxlttx.zoq.exe
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
3184	Explorer.EXE
4052	2dbxlttx.zoq.exe
4052	2dbxlttx.zoq.exe
4052	2dbxlttx.zoq.exe
4052	2dbxlttx.zoq.exe
4052	2dbxlttx.zoq.exe
4052	2dbxlttx.zoq.exe
4052	2dbxlttx.zoq.exe
4052	2dbxlttx.zoq.exe
4052	2dbxlttx.zoq.exe
4052	2dbxlttx.zoq.exe
4052	2dbxlttx.zoq.exe
4052	2dbxlttx.zoq.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3184	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1396	svchost.exe
Token: SeDebugPrivilege	4052	2dbxlttx.zoq.exe
Token: SeDebugPrivilege	3184	Explorer.EXE
Token: SeShutdownPrivilege	3184	Explorer.EXE
Token: SeCreatePagefilePrivilege	3184	Explorer.EXE
Token: SeShutdownPrivilege	3184	Explorer.EXE
Token: SeCreatePagefilePrivilege	3184	Explorer.EXE

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1396 wrote to memory of 4052	1396	svchost.exe	80
PID 1396 wrote to memory of 3184	1396	svchost.exe	54
PID 4052 wrote to memory of 640	4052	2dbxlttx.zoq.exe	5
PID 4052 wrote to memory of 692	4052	2dbxlttx.zoq.exe	7
PID 4052 wrote to memory of 900	4052	2dbxlttx.zoq.exe	11
PID 4052 wrote to memory of 352	4052	2dbxlttx.zoq.exe	13
PID 4052 wrote to memory of 712	4052	2dbxlttx.zoq.exe	14
PID 4052 wrote to memory of 1044	4052	2dbxlttx.zoq.exe	15
PID 4052 wrote to memory of 1100	4052	2dbxlttx.zoq.exe	16
PID 4052 wrote to memory of 1172	4052	2dbxlttx.zoq.exe	18
PID 4052 wrote to memory of 1188	4052	2dbxlttx.zoq.exe	19
PID 4052 wrote to memory of 1216	4052	2dbxlttx.zoq.exe	20
PID 4052 wrote to memory of 1232	4052	2dbxlttx.zoq.exe	21
PID 4052 wrote to memory of 1348	4052	2dbxlttx.zoq.exe	22
PID 4052 wrote to memory of 1364	4052	2dbxlttx.zoq.exe	23
PID 4052 wrote to memory of 1408	4052	2dbxlttx.zoq.exe	24
PID 4052 wrote to memory of 1444	4052	2dbxlttx.zoq.exe	25
PID 4052 wrote to memory of 1492	4052	2dbxlttx.zoq.exe	26
PID 4052 wrote to memory of 1744	4052	2dbxlttx.zoq.exe	27
PID 4052 wrote to memory of 1752	4052	2dbxlttx.zoq.exe	28
PID 4052 wrote to memory of 1780	4052	2dbxlttx.zoq.exe	29
PID 4052 wrote to memory of 1788	4052	2dbxlttx.zoq.exe	30
PID 4052 wrote to memory of 1896	4052	2dbxlttx.zoq.exe	31
PID 4052 wrote to memory of 1936	4052	2dbxlttx.zoq.exe	32
PID 4052 wrote to memory of 1976	4052	2dbxlttx.zoq.exe	33
PID 4052 wrote to memory of 2032	4052	2dbxlttx.zoq.exe	34
PID 4052 wrote to memory of 1660	4052	2dbxlttx.zoq.exe	35
PID 4052 wrote to memory of 1800	4052	2dbxlttx.zoq.exe	36
PID 4052 wrote to memory of 2124	4052	2dbxlttx.zoq.exe	37
PID 4052 wrote to memory of 2204	4052	2dbxlttx.zoq.exe	38
PID 4052 wrote to memory of 2212	4052	2dbxlttx.zoq.exe	39
PID 4052 wrote to memory of 2344	4052	2dbxlttx.zoq.exe	41
PID 4052 wrote to memory of 2528	4052	2dbxlttx.zoq.exe	42
PID 4052 wrote to memory of 2536	4052	2dbxlttx.zoq.exe	43
PID 4052 wrote to memory of 2580	4052	2dbxlttx.zoq.exe	44
PID 4052 wrote to memory of 2592	4052	2dbxlttx.zoq.exe	45
PID 4052 wrote to memory of 2672	4052	2dbxlttx.zoq.exe	46
PID 4052 wrote to memory of 2688	4052	2dbxlttx.zoq.exe	47
PID 4052 wrote to memory of 2712	4052	2dbxlttx.zoq.exe	48
PID 4052 wrote to memory of 2724	4052	2dbxlttx.zoq.exe	49
PID 4052 wrote to memory of 2304	4052	2dbxlttx.zoq.exe	51
PID 4052 wrote to memory of 2828	4052	2dbxlttx.zoq.exe	52
PID 4052 wrote to memory of 1280	4052	2dbxlttx.zoq.exe	53
PID 4052 wrote to memory of 3184	4052	2dbxlttx.zoq.exe	54
PID 4052 wrote to memory of 3312	4052	2dbxlttx.zoq.exe	55
PID 4052 wrote to memory of 3360	4052	2dbxlttx.zoq.exe	56
PID 4052 wrote to memory of 3692	4052	2dbxlttx.zoq.exe	59
PID 4052 wrote to memory of 3756	4052	2dbxlttx.zoq.exe	60
PID 4052 wrote to memory of 3804	4052	2dbxlttx.zoq.exe	61
PID 4052 wrote to memory of 3836	4052	2dbxlttx.zoq.exe	62
PID 4052 wrote to memory of 4232	4052	2dbxlttx.zoq.exe	63
PID 4052 wrote to memory of 4268	4052	2dbxlttx.zoq.exe	64
PID 4052 wrote to memory of 1156	4052	2dbxlttx.zoq.exe	68
PID 4052 wrote to memory of 4800	4052	2dbxlttx.zoq.exe	69
PID 4052 wrote to memory of 2508	4052	2dbxlttx.zoq.exe	71
PID 4052 wrote to memory of 396	4052	2dbxlttx.zoq.exe	72
PID 4052 wrote to memory of 1272	4052	2dbxlttx.zoq.exe	73
PID 4052 wrote to memory of 1224	4052	2dbxlttx.zoq.exe	74
PID 4052 wrote to memory of 3156	4052	2dbxlttx.zoq.exe	75
PID 4052 wrote to memory of 2852	4052	2dbxlttx.zoq.exe	76
PID 4052 wrote to memory of 4344	4052	2dbxlttx.zoq.exe	77
PID 4052 wrote to memory of 1396	4052	2dbxlttx.zoq.exe	79

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:640
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:712

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:692

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-9b845ae1-287c-43da-a6d7-5a05530b7b1b -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f13bbb43-cd38-465f-a550-2d3315ebc629 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-19b92eb7-c516-415c-9a4b-acd646d9c3d4 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-0d30b5df-d855-4249-9aab-5d32ab568203 -LifetimeId:6baddfff-2938-456d-b22e-d53f8c3b4688 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:900

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1044

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1172

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1188

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1216
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:1280

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1492
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1780

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1800

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2124

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2204

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2212

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2536

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2580

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2592

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2712

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2828

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Creates a file in the Startup directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3184
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Executes a file named after a Windows system binary
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Users\Admin\AppData\Local\Temp\2dbxlttx.zoq.exe
    "C:\Users\Admin\AppData\Local\Temp\2dbxlttx.zoq.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4052

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3360

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3692

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3756

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3836

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4268

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:1156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4800

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:2508

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:396

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:1272

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3156

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2dbxlttx.zoq.exe

Path C:\Users\Admin\AppData\Local\Temp\2dbxlttx.zoq.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/352-38-0x0000022E2ADC0000-0x0000022E2ADEB000-memory.dmp

Download

memory/352-267-0x0000022E2ADC0000-0x0000022E2ADEB000-memory.dmp

Download

memory/352-33-0x0000022E2ADC0000-0x0000022E2ADEB000-memory.dmp

Download

memory/352-34-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/640-14-0x0000021636DB0000-0x0000021636DD5000-memory.dmp

Download

memory/640-22-0x0000021637000000-0x000002163702B000-memory.dmp

Download

memory/640-15-0x0000021637000000-0x000002163702B000-memory.dmp

Download

memory/640-16-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/692-23-0x000001395E060000-0x000001395E08B000-memory.dmp

Download

memory/692-20-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/692-19-0x000001395E060000-0x000001395E08B000-memory.dmp

Download

memory/712-36-0x0000020470080000-0x00000204700AB000-memory.dmp

Download

memory/712-28-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/712-27-0x0000020470080000-0x00000204700AB000-memory.dmp

Download

memory/900-266-0x000001526AB90000-0x000001526ABBB000-memory.dmp

Download

memory/900-31-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/900-37-0x000001526AB90000-0x000001526ABBB000-memory.dmp

Download

memory/900-30-0x000001526AB90000-0x000001526ABBB000-memory.dmp

Download

memory/1044-40-0x00000141CC1D0000-0x00000141CC1FB000-memory.dmp

Download

memory/1044-43-0x00000141CC1D0000-0x00000141CC1FB000-memory.dmp

Download

memory/1044-41-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1044-273-0x00000141CC1D0000-0x00000141CC1FB000-memory.dmp

Download

memory/1100-210-0x000002AE3CBC0000-0x000002AE3CBEB000-memory.dmp

Download

memory/1100-81-0x000002AE3CBC0000-0x000002AE3CBEB000-memory.dmp

Download

memory/1100-104-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1172-106-0x0000021C07950000-0x0000021C0797B000-memory.dmp

Download

memory/1172-107-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1188-109-0x000002E3AC960000-0x000002E3AC98B000-memory.dmp

Download

memory/1188-110-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1216-112-0x000001AF68A90000-0x000001AF68ABB000-memory.dmp

Download

memory/1216-113-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1232-116-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1232-115-0x000001E4A2760000-0x000001E4A278B000-memory.dmp

Download

memory/1348-118-0x000002469A600000-0x000002469A62B000-memory.dmp

Download

memory/1348-119-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1364-121-0x00000243EDAB0000-0x00000243EDADB000-memory.dmp

Download

memory/1364-122-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1396-11-0x00000200D5C80000-0x00000200D5D70000-memory.dmp

Download

memory/1396-1-0x00000200B9960000-0x00000200B998C000-memory.dmp

Download

memory/1396-0-0x00000200B9350000-0x00000200B9472000-memory.dmp

Download

memory/1408-124-0x000001DDC2D10000-0x000001DDC2D3B000-memory.dmp

Download

memory/1408-125-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1444-128-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1444-127-0x000002AA20C60000-0x000002AA20C8B000-memory.dmp

Download

memory/1492-130-0x0000017B712A0000-0x0000017B712CB000-memory.dmp

Download

memory/1492-131-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1660-158-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1660-157-0x00000202FC140000-0x00000202FC16B000-memory.dmp

Download

memory/1744-133-0x000001E5A6BC0000-0x000001E5A6BEB000-memory.dmp

Download

memory/1744-134-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1752-137-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1752-136-0x00000247A6B90000-0x00000247A6BBB000-memory.dmp

Download

memory/1780-140-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1780-139-0x00000197B0BA0000-0x00000197B0BCB000-memory.dmp

Download

memory/1788-142-0x0000025A257B0000-0x0000025A257DB000-memory.dmp

Download

memory/1788-143-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1800-161-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1800-160-0x000001DAD8430000-0x000001DAD845B000-memory.dmp

Download

memory/1896-146-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1896-145-0x00000226DF520000-0x00000226DF54B000-memory.dmp

Download

memory/1936-148-0x0000019C02290000-0x0000019C022BB000-memory.dmp

Download

memory/1936-149-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/1976-151-0x0000018979D30000-0x0000018979D5B000-memory.dmp

Download

memory/1976-152-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/2032-155-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/2032-154-0x00000243E8B80000-0x00000243E8BAB000-memory.dmp

Download

memory/2124-164-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/2124-163-0x000002CF40890000-0x000002CF408BB000-memory.dmp

Download

memory/2204-167-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/2204-166-0x0000000001EC0000-0x0000000001EEB000-memory.dmp

Download

memory/2212-170-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/2212-169-0x00000240089B0000-0x00000240089DB000-memory.dmp

Download

memory/3184-83-0x00007FFE32450000-0x00007FFE32460000-memory.dmp

Download

memory/3184-82-0x000000000DC40000-0x000000000DC6B000-memory.dmp

Download

memory/3184-80-0x0000000007DD0000-0x0000000007EB6000-memory.dmp

Download

memory/3184-209-0x00000000079F0000-0x0000000007A00000-memory.dmp

Download

memory/3184-208-0x00000000079F0000-0x0000000007A00000-memory.dmp

Download

memory/3184-13-0x0000000004950000-0x0000000004A39000-memory.dmp

Download

memory/4052-10-0x00007FFE723C0000-0x00007FFE725C9000-memory.dmp

Download

memory/4052-12-0x00007FFE712C0000-0x00007FFE7137D000-memory.dmp

Download