donutloader | 047a01e176919ef652998a9e84bb886fd42cb666540bd63c4e07a31c988696cb

Analysis

max time kernel
4s
max time network
5s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
svchost.exe
Size 1.1MB
Sample261102-tmvxasdv9m
SHA256 047a01e176919ef652998a9e84bb886fd42cb666540bd63c4e07a31c988696cb
MD5 88820e7795c7979689895de5c38dd65c
SHA1 b539ada032cb04cef0b1a93a201da1e5cb6fb4d5
SHA512 3804fb1010da368518bd26aad5a5a98fa0bad236d0175a0efa6558c2916625b81410970f3cd7bcb8cba7b2df3ed5a9688a40cceca51edd25904290a4c945a169
SSDEEP 24576:D+o11C2Fe8IQXNK9eHzDQ92glXI/WiUXDNVGwiKhZdXbn:yoa2Q8/NKQHzssGX4WiUXDNVG5KTdr
TLSH
T1A33502A3F6A000FAD46681748D635B06B7B6F07A0320A7FF0B94595C7F637B05D29B91
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion donutloader loader

Malware Config

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader

Detects DonutLoader 3 IoCs

loader

resource	yara_rule
behavioral1/memory/2216-0-0x00000159DE170000-0x00000159DE292000-memory.dmp	family_donutloader
behavioral1/memory/3372-12-0x00000000087B0000-0x0000000008899000-memory.dmp	family_donutloader
behavioral1/memory/2216-10-0x00000159F8CF0000-0x00000159F8DE0000-memory.dmp	family_donutloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes a file named after a Windows system binary 1 TTPs 1 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\svchost.exe	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3984	orc2h4nn.1br.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "001840190721440D"	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2216	svchost.exe
2216	svchost.exe
3984	orc2h4nn.1br.exe
3984	orc2h4nn.1br.exe
3984	orc2h4nn.1br.exe
3984	orc2h4nn.1br.exe
3984	orc2h4nn.1br.exe
3984	orc2h4nn.1br.exe
3984	orc2h4nn.1br.exe
3984	orc2h4nn.1br.exe
3372	Explorer.EXE
3984	orc2h4nn.1br.exe
3984	orc2h4nn.1br.exe
3984	orc2h4nn.1br.exe
3984	orc2h4nn.1br.exe
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3984	orc2h4nn.1br.exe
3984	orc2h4nn.1br.exe
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3984	orc2h4nn.1br.exe
3984	orc2h4nn.1br.exe
3372	Explorer.EXE
3372	Explorer.EXE
3984	orc2h4nn.1br.exe
3984	orc2h4nn.1br.exe
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3984	orc2h4nn.1br.exe
3984	orc2h4nn.1br.exe
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3984	orc2h4nn.1br.exe
3984	orc2h4nn.1br.exe
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE
3372	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2216	svchost.exe
Token: SeDebugPrivilege	3984	orc2h4nn.1br.exe
Token: SeDebugPrivilege	3372	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2216 wrote to memory of 3984	2216	svchost.exe	84
PID 2216 wrote to memory of 3372	2216	svchost.exe	56
PID 3984 wrote to memory of 608	3984	orc2h4nn.1br.exe	5
PID 3984 wrote to memory of 664	3984	orc2h4nn.1br.exe	7
PID 3984 wrote to memory of 884	3984	orc2h4nn.1br.exe	11
PID 3984 wrote to memory of 1012	3984	orc2h4nn.1br.exe	13
PID 3984 wrote to memory of 516	3984	orc2h4nn.1br.exe	14
PID 3984 wrote to memory of 616	3984	orc2h4nn.1br.exe	15
PID 3984 wrote to memory of 1044	3984	orc2h4nn.1br.exe	16
PID 3984 wrote to memory of 1084	3984	orc2h4nn.1br.exe	17
PID 3984 wrote to memory of 1092	3984	orc2h4nn.1br.exe	18
PID 3984 wrote to memory of 1152	3984	orc2h4nn.1br.exe	19
PID 3984 wrote to memory of 1228	3984	orc2h4nn.1br.exe	21
PID 3984 wrote to memory of 1288	3984	orc2h4nn.1br.exe	22
PID 3984 wrote to memory of 1352	3984	orc2h4nn.1br.exe	23
PID 3984 wrote to memory of 1492	3984	orc2h4nn.1br.exe	24
PID 3984 wrote to memory of 1500	3984	orc2h4nn.1br.exe	25
PID 3984 wrote to memory of 1524	3984	orc2h4nn.1br.exe	26
PID 3984 wrote to memory of 1548	3984	orc2h4nn.1br.exe	27
PID 3984 wrote to memory of 1612	3984	orc2h4nn.1br.exe	28
PID 3984 wrote to memory of 1724	3984	orc2h4nn.1br.exe	29
PID 3984 wrote to memory of 1732	3984	orc2h4nn.1br.exe	30
PID 3984 wrote to memory of 1796	3984	orc2h4nn.1br.exe	31
PID 3984 wrote to memory of 1892	3984	orc2h4nn.1br.exe	32
PID 3984 wrote to memory of 1920	3984	orc2h4nn.1br.exe	33
PID 3984 wrote to memory of 2004	3984	orc2h4nn.1br.exe	34
PID 3984 wrote to memory of 2044	3984	orc2h4nn.1br.exe	35
PID 3984 wrote to memory of 1452	3984	orc2h4nn.1br.exe	36
PID 3984 wrote to memory of 1640	3984	orc2h4nn.1br.exe	37
PID 3984 wrote to memory of 2068	3984	orc2h4nn.1br.exe	38
PID 3984 wrote to memory of 2136	3984	orc2h4nn.1br.exe	39
PID 3984 wrote to memory of 2232	3984	orc2h4nn.1br.exe	41
PID 3984 wrote to memory of 2392	3984	orc2h4nn.1br.exe	42
PID 3984 wrote to memory of 2456	3984	orc2h4nn.1br.exe	43
PID 3984 wrote to memory of 2640	3984	orc2h4nn.1br.exe	45
PID 3984 wrote to memory of 2648	3984	orc2h4nn.1br.exe	46
PID 3984 wrote to memory of 2808	3984	orc2h4nn.1br.exe	47
PID 3984 wrote to memory of 2872	3984	orc2h4nn.1br.exe	48
PID 3984 wrote to memory of 2924	3984	orc2h4nn.1br.exe	49
PID 3984 wrote to memory of 2932	3984	orc2h4nn.1br.exe	50
PID 3984 wrote to memory of 2940	3984	orc2h4nn.1br.exe	51
PID 3984 wrote to memory of 3028	3984	orc2h4nn.1br.exe	52
PID 3984 wrote to memory of 3056	3984	orc2h4nn.1br.exe	53
PID 3984 wrote to memory of 2704	3984	orc2h4nn.1br.exe	54
PID 3984 wrote to memory of 3288	3984	orc2h4nn.1br.exe	55
PID 3984 wrote to memory of 3372	3984	orc2h4nn.1br.exe	56
PID 3984 wrote to memory of 3488	3984	orc2h4nn.1br.exe	57
PID 3984 wrote to memory of 3696	3984	orc2h4nn.1br.exe	58
PID 3984 wrote to memory of 3868	3984	orc2h4nn.1br.exe	60
PID 3984 wrote to memory of 776	3984	orc2h4nn.1br.exe	62
PID 3984 wrote to memory of 4512	3984	orc2h4nn.1br.exe	65
PID 3984 wrote to memory of 1320	3984	orc2h4nn.1br.exe	67
PID 3984 wrote to memory of 2372	3984	orc2h4nn.1br.exe	69
PID 3984 wrote to memory of 5096	3984	orc2h4nn.1br.exe	70
PID 3984 wrote to memory of 2036	3984	orc2h4nn.1br.exe	71
PID 3984 wrote to memory of 3576	3984	orc2h4nn.1br.exe	72
PID 3984 wrote to memory of 2260	3984	orc2h4nn.1br.exe	73
PID 3984 wrote to memory of 4560	3984	orc2h4nn.1br.exe	74
PID 3984 wrote to memory of 2348	3984	orc2h4nn.1br.exe	75
PID 3984 wrote to memory of 412	3984	orc2h4nn.1br.exe	76
PID 3984 wrote to memory of 4740	3984	orc2h4nn.1br.exe	78
PID 3984 wrote to memory of 3832	3984	orc2h4nn.1br.exe	81
PID 3984 wrote to memory of 2216	3984	orc2h4nn.1br.exe	83
PID 3984 wrote to memory of 5012	3984	orc2h4nn.1br.exe	85

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:608
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:516

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3173b0d4-8774-42c5-b99c-00d97d6c5234 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-1a450c31-9ee1-4d69-ae25-55721feaedbc -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e69c77e5-2055-444f-b08d-11e097545b95 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-8aee93ce-5b18-4f5b-97fe-dd378af4a3ee -LifetimeId:f675061d-7eca-493e-b07b-0e4bc8b18ca9 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:616

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1084

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1152
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2932
- C:\Windows\system32\MusNotification.exe
  C:\Windows\system32\MusNotification.exe
  2⤵
  PID:3832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1288

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1352

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1500

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1548
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1796

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1892

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1920

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:2004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2068

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2136

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2872

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2940

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3288

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3372
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Checks computer location settings
  - Executes a file named after a Windows system binary
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Users\Admin\AppData\Local\Temp\orc2h4nn.1br.exe
    "C:\Users\Admin\AppData\Local\Temp\orc2h4nn.1br.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3984

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3488

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3696

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3868

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:776

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:2372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:5096

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:2036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3576

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Modifies data under HKEY_USERS
PID:4560

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:2348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:412

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4740

C:\Windows\System32\WaaSMedicAgent.exe
C:\Windows\System32\WaaSMedicAgent.exe e39f0416ba578db39a19cf94e67349c3 5LcVAykBHEyvbXKVgrglSA.0.1.0.0.0
1⤵
PID:5012
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

orc2h4nn.1br.exe

Path C:\Users\Admin\AppData\Local\Temp\orc2h4nn.1br.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/516-27-0x00000264EE080000-0x00000264EE0AB000-memory.dmp

Download

memory/516-36-0x00000264EE080000-0x00000264EE0AB000-memory.dmp

Download

memory/516-28-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/608-15-0x0000022D81F30000-0x0000022D81F5B000-memory.dmp

Download

memory/608-22-0x0000022D81F30000-0x0000022D81F5B000-memory.dmp

Download

memory/608-16-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/608-14-0x0000022D81F00000-0x0000022D81F25000-memory.dmp

Download

memory/616-43-0x000001D579B40000-0x000001D579B6B000-memory.dmp

Download

memory/616-40-0x000001D579B40000-0x000001D579B6B000-memory.dmp

Download

memory/616-41-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/616-150-0x000001D579B40000-0x000001D579B6B000-memory.dmp

Download

memory/664-19-0x000002B8C6E00000-0x000002B8C6E2B000-memory.dmp

Download

memory/664-20-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/664-23-0x000002B8C6E00000-0x000002B8C6E2B000-memory.dmp

Download

memory/884-81-0x0000029CC9B60000-0x0000029CC9B8B000-memory.dmp

Download

memory/884-30-0x0000029CC9B60000-0x0000029CC9B8B000-memory.dmp

Download

memory/884-31-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/884-37-0x0000029CC9B60000-0x0000029CC9B8B000-memory.dmp

Download

memory/1012-82-0x0000021491400000-0x000002149142B000-memory.dmp

Download

memory/1012-34-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1012-33-0x0000021491400000-0x000002149142B000-memory.dmp

Download

memory/1012-38-0x0000021491400000-0x000002149142B000-memory.dmp

Download

memory/1044-47-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1044-46-0x00000284B6E90000-0x00000284B6EBB000-memory.dmp

Download

memory/1044-289-0x00000284B6E90000-0x00000284B6EBB000-memory.dmp

Download

memory/1044-52-0x00000284B6E90000-0x00000284B6EBB000-memory.dmp

Download

memory/1084-290-0x000002139AB70000-0x000002139AB9B000-memory.dmp

Download

memory/1084-53-0x000002139AB70000-0x000002139AB9B000-memory.dmp

Download

memory/1084-49-0x000002139AB70000-0x000002139AB9B000-memory.dmp

Download

memory/1084-50-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1092-62-0x000002AECA1C0000-0x000002AECA1EB000-memory.dmp

Download

memory/1092-301-0x000002AECA1C0000-0x000002AECA1EB000-memory.dmp

Download

memory/1092-57-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1092-56-0x000002AECA1C0000-0x000002AECA1EB000-memory.dmp

Download

memory/1152-63-0x00000188EC530000-0x00000188EC55B000-memory.dmp

Download

memory/1152-302-0x00000188EC530000-0x00000188EC55B000-memory.dmp

Download

memory/1152-59-0x00000188EC530000-0x00000188EC55B000-memory.dmp

Download

memory/1152-60-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1228-65-0x000001C4F8D40000-0x000001C4F8D6B000-memory.dmp

Download

memory/1228-66-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1228-68-0x000001C4F8D40000-0x000001C4F8D6B000-memory.dmp

Download

memory/1288-73-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1288-83-0x000002660CF60000-0x000002660CF8B000-memory.dmp

Download

memory/1288-72-0x000002660CF60000-0x000002660CF8B000-memory.dmp

Download

memory/1352-75-0x000001B7E0EA0000-0x000001B7E0ECB000-memory.dmp

Download

memory/1352-76-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1352-84-0x000001B7E0EA0000-0x000001B7E0ECB000-memory.dmp

Download

memory/1452-135-0x000001FCC86A0000-0x000001FCC86CB000-memory.dmp

Download

memory/1452-136-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1452-162-0x000001FCC86A0000-0x000001FCC86CB000-memory.dmp

Download

memory/1492-79-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1492-78-0x0000022C6F5D0000-0x0000022C6F5FB000-memory.dmp

Download

memory/1492-85-0x0000022C6F5D0000-0x0000022C6F5FB000-memory.dmp

Download

memory/1500-102-0x000001EFCE8C0000-0x000001EFCE8EB000-memory.dmp

Download

memory/1500-151-0x000001EFCE8C0000-0x000001EFCE8EB000-memory.dmp

Download

memory/1500-103-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1524-105-0x000001C8737D0000-0x000001C8737FB000-memory.dmp

Download

memory/1524-106-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1524-152-0x000001C8737D0000-0x000001C8737FB000-memory.dmp

Download

memory/1548-108-0x0000020032830000-0x000002003285B000-memory.dmp

Download

memory/1548-109-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1548-153-0x0000020032830000-0x000002003285B000-memory.dmp

Download

memory/1612-112-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1612-111-0x0000028E21CD0000-0x0000028E21CFB000-memory.dmp

Download

memory/1612-154-0x0000028E21CD0000-0x0000028E21CFB000-memory.dmp

Download

memory/1640-138-0x00000193D19B0000-0x00000193D19DB000-memory.dmp

Download

memory/1640-139-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1724-114-0x000002B73DCB0000-0x000002B73DCDB000-memory.dmp

Download

memory/1724-115-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1724-155-0x000002B73DCB0000-0x000002B73DCDB000-memory.dmp

Download

memory/1732-156-0x0000024DE8CB0000-0x0000024DE8CDB000-memory.dmp

Download

memory/1732-117-0x0000024DE8CB0000-0x0000024DE8CDB000-memory.dmp

Download

memory/1732-118-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1796-157-0x0000020234740000-0x000002023476B000-memory.dmp

Download

memory/1796-121-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1796-120-0x0000020234740000-0x000002023476B000-memory.dmp

Download

memory/1892-124-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/1892-158-0x000001D8D47B0000-0x000001D8D47DB000-memory.dmp

Download

memory/1892-123-0x000001D8D47B0000-0x000001D8D47DB000-memory.dmp

Download

memory/1920-159-0x00000252187B0000-0x00000252187DB000-memory.dmp

Download

memory/1920-126-0x00000252187B0000-0x00000252187DB000-memory.dmp

Download

memory/1920-127-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/2004-130-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/2004-129-0x00000244C9400000-0x00000244C942B000-memory.dmp

Download

memory/2004-160-0x00000244C9400000-0x00000244C942B000-memory.dmp

Download

memory/2044-161-0x00000182F7D60000-0x00000182F7D8B000-memory.dmp

Download

memory/2044-132-0x00000182F7D60000-0x00000182F7D8B000-memory.dmp

Download

memory/2044-133-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/2068-142-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/2068-141-0x00000236B5930000-0x00000236B595B000-memory.dmp

Download

memory/2136-145-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/2136-144-0x0000000000C30000-0x0000000000C5B000-memory.dmp

Download

memory/2216-0-0x00000159DE170000-0x00000159DE292000-memory.dmp

Download

memory/2216-10-0x00000159F8CF0000-0x00000159F8DE0000-memory.dmp

Download

memory/2216-1-0x00000159F8760000-0x00000159F878C000-memory.dmp

Download

memory/2232-148-0x00007FFECE890000-0x00007FFECE8A0000-memory.dmp

Download

memory/2232-147-0x000001D5B7A40000-0x000001D5B7A6B000-memory.dmp

Download

memory/3372-292-0x0000000009810000-0x00000000098F6000-memory.dmp

Download

memory/3372-12-0x00000000087B0000-0x0000000008899000-memory.dmp

Download

memory/3984-13-0x00007FFF0E0E0000-0x00007FFF0E19E000-memory.dmp

Download

memory/3984-11-0x00007FFF0E810000-0x00007FFF0EA05000-memory.dmp

Download