formbook | 503f221f367baedb8a7c4aa592c21af73eb9bf6be4fe4a18b5588c0e9e6f9e23

Analysis

max time kernel
154s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
09/02/2022, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ödeme kanıtı.exe
Size 809KB
Sample220209-syn3fsbaan
SHA256 503f221f367baedb8a7c4aa592c21af73eb9bf6be4fe4a18b5588c0e9e6f9e23
MD5 85dd83ecde842f52cdd6c2e144eaed7d
SHA1 8e422311d20c1a735a31f3976243f44992ab40d4
SHA512 4ab2171cac5459791f6458bc8e3fccd4a7cf902391526841f3f59afbd3fcb0bc7228833f477878b9b75e3c1b30800cf89082b36df531e00795d3eb7ec949095d
MD5 SHA1 SHA512

Score

10^/10

formbook gn27 rat spyware stealer suricata trojan

Malware Config

Extracted

Family

formbook

Version

Campaign

gn27

Decoy

perilunevc.com
kantogaming.com
stageyor.online
jixsux.site
dingmei2020.icu
savagesupplyco.com
deadstockllc.com
leyandfey.com
zjn22558800.com
projectupskill.net
outliersresearch.com
spaced.community
zschengbangzx.com
5gxzxxtax-ety7f.biz
iq0xe.com
6388xp9xg9k.com
hengyungdzz.com
retrosale.com
echt.global
canceltotalav.com
healthandwealthacademy.com
sundaymailonline.com
neoboss2022.biz
rexstores.store
doorkid.com
sustainabledigitalnomads.com
asistencia-clientes-24h.site
directorytrees.com
thelocalejastipbeauty.com
yourkms.com
blackeyedsuzies.store
sarafitat.com
veganbroflex.com
xn--adlerbergrsse-rmb8f.com
c9qct.com
yangtufeng.com
dubailivegames.com
fasterthantom.com
diversumrealestate.com
bsnua.icu
accessiblemovements.mobi
junzhishang.com
niharexim.com
wvnin.com
camilluslife.com
worksbyjustinesparks.com
ndekns.com
marvincardenas.com
hightensionart.net
webpowertech.com
annuplus.net
gailbrickmanrealestate.com
hilirselatan.com
travelgabbers.com
syncitymafia.digital
lcsprodutos.com
jtd-immobiliare.com
omm65.com
peakbi.world
ackuo.icu
itlandsocialnetwork.com
thejennymaraghyteam.com
ploykaua.space
escobarchalkco.com
tectoniclondon.net

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata

Formbook Payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/864-144-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/1616-156-0x0000000002C70000-0x0000000002C9F000-memory.dmp	formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	Ödeme kanıtı.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3624 set thread context of 864	3624	Ödeme kanıtı.exe	76
PID 864 set thread context of 2364	864	RegSvcs.exe	34
PID 1616 set thread context of 2364	1616	svchost.exe	34

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3848	schtasks.exe

Modifies data under HKEY_USERS 47 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "3.205047"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132890707517531658"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "3876"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4024"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000"	svchost.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
3624	Ödeme kanıtı.exe
3624	Ödeme kanıtı.exe
3624	Ödeme kanıtı.exe
3624	Ödeme kanıtı.exe
672	powershell.exe
864	RegSvcs.exe
864	RegSvcs.exe
864	RegSvcs.exe
864	RegSvcs.exe
672	powershell.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe
1616	svchost.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2364	Explorer.EXE

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
864	RegSvcs.exe
864	RegSvcs.exe
864	RegSvcs.exe
1616	svchost.exe
1616	svchost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	3624	Ödeme kanıtı.exe
Token: SeDebugPrivilege	672	powershell.exe
Token: SeDebugPrivilege	864	RegSvcs.exe
Token: SeDebugPrivilege	1616	svchost.exe
Token: SeShutdownPrivilege	2364	Explorer.EXE
Token: SeCreatePagefilePrivilege	2364	Explorer.EXE
Token: SeShutdownPrivilege	2364	Explorer.EXE
Token: SeCreatePagefilePrivilege	2364	Explorer.EXE

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 672	3624	Ödeme kanıtı.exe	72
PID 3624 wrote to memory of 672	3624	Ödeme kanıtı.exe	72
PID 3624 wrote to memory of 672	3624	Ödeme kanıtı.exe	72
PID 3624 wrote to memory of 3848	3624	Ödeme kanıtı.exe	74
PID 3624 wrote to memory of 3848	3624	Ödeme kanıtı.exe	74
PID 3624 wrote to memory of 3848	3624	Ödeme kanıtı.exe	74
PID 3624 wrote to memory of 864	3624	Ödeme kanıtı.exe	76
PID 3624 wrote to memory of 864	3624	Ödeme kanıtı.exe	76
PID 3624 wrote to memory of 864	3624	Ödeme kanıtı.exe	76
PID 3624 wrote to memory of 864	3624	Ödeme kanıtı.exe	76
PID 3624 wrote to memory of 864	3624	Ödeme kanıtı.exe	76
PID 3624 wrote to memory of 864	3624	Ödeme kanıtı.exe	76
PID 2364 wrote to memory of 1616	2364	Explorer.EXE	78
PID 2364 wrote to memory of 1616	2364	Explorer.EXE	78
PID 2364 wrote to memory of 1616	2364	Explorer.EXE	78
PID 1616 wrote to memory of 1924	1616	svchost.exe	79
PID 1616 wrote to memory of 1924	1616	svchost.exe	79
PID 1616 wrote to memory of 1924	1616	svchost.exe	79

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Users\Admin\AppData\Local\Temp\Ödeme kanıtı.exe
  "C:\Users\Admin\AppData\Local\Temp\Ödeme kanıtı.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tDvArNEAiSxmk.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:672
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tDvArNEAiSxmk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4CFF.tmp"
    3⤵
    - Creates scheduled task(s)
    PID:3848
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of AdjustPrivilegeToken
    PID:864
- C:\Windows\SysWOW64\autoconv.exe
  "C:\Windows\SysWOW64\autoconv.exe"
  2⤵
  PID:2548
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\SysWOW64\svchost.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:1924

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:1332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:216

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/672-160-0x0000000070FD0000-0x000000007101C000-memory.dmp

Download

memory/672-162-0x000000007EF90000-0x000000007EF91000-memory.dmp

Download

memory/672-169-0x0000000009800000-0x0000000009808000-memory.dmp

Download

memory/672-168-0x0000000009820000-0x000000000983A000-memory.dmp

Download

memory/672-167-0x0000000009710000-0x000000000971E000-memory.dmp

Download

memory/672-166-0x0000000009760000-0x00000000097F6000-memory.dmp

Download

memory/672-139-0x00000000746FE000-0x00000000746FF000-memory.dmp

Download

memory/672-140-0x0000000006EA0000-0x0000000006EA1000-memory.dmp

Download

memory/672-141-0x00000000048E0000-0x0000000004916000-memory.dmp

Download

memory/672-154-0x0000000006F70000-0x0000000006F8E000-memory.dmp

Download

memory/672-143-0x00000000074E0000-0x0000000007B08000-memory.dmp

Download

memory/672-165-0x0000000009550000-0x000000000955A000-memory.dmp

Download

memory/672-145-0x0000000007100000-0x0000000007122000-memory.dmp

Download

memory/672-146-0x0000000006EA2000-0x0000000006EA3000-memory.dmp

Download

memory/672-148-0x00000000073A0000-0x0000000007406000-memory.dmp

Download

memory/672-149-0x0000000007B80000-0x0000000007BE6000-memory.dmp

Download

memory/672-164-0x00000000094F0000-0x000000000950A000-memory.dmp

Download

memory/672-163-0x0000000009B50000-0x000000000A1CA000-memory.dmp

Download

memory/672-161-0x0000000008760000-0x000000000877E000-memory.dmp

Download

memory/672-159-0x00000000087A0000-0x00000000087D2000-memory.dmp

Download

memory/672-158-0x0000000006EA5000-0x0000000006EA7000-memory.dmp

Download

memory/864-151-0x000000000041F000-0x0000000000420000-memory.dmp

Download

memory/864-152-0x00000000014C0000-0x00000000014D4000-memory.dmp

Download

memory/864-144-0x0000000000400000-0x000000000042F000-memory.dmp

Download

memory/864-150-0x0000000001150000-0x000000000149A000-memory.dmp

Download

memory/1616-155-0x0000000000960000-0x000000000096E000-memory.dmp

Download

memory/1616-157-0x0000000003700000-0x0000000003A4A000-memory.dmp

Download

memory/1616-171-0x0000000003600000-0x0000000003693000-memory.dmp

Download

memory/1616-156-0x0000000002C70000-0x0000000002C9F000-memory.dmp

Download

memory/2364-153-0x00000000083B0000-0x0000000008557000-memory.dmp

Download

memory/2364-172-0x0000000008BC0000-0x0000000008D1C000-memory.dmp

Download

memory/3624-132-0x0000000005B60000-0x0000000006104000-memory.dmp

Download

memory/3624-130-0x00000000746FE000-0x00000000746FF000-memory.dmp

Download

memory/3624-136-0x0000000007A90000-0x0000000007B2C000-memory.dmp

Download

memory/3624-135-0x0000000005640000-0x000000000564A000-memory.dmp

Download

memory/3624-134-0x00000000055C0000-0x00000000055C1000-memory.dmp

Download

memory/3624-133-0x0000000005650000-0x00000000056E2000-memory.dmp

Download

memory/3624-131-0x0000000000BD0000-0x0000000000CA0000-memory.dmp

Download