formbook | e9e09c2f8031763a0c8494d500bd28ca3adc87d5f700111255db99f8142f2933

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 19:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LMZ0324051754536245.PDF.bin.exe
Size 524KB
Sample240522-x5evksdf66
SHA256 e9e09c2f8031763a0c8494d500bd28ca3adc87d5f700111255db99f8142f2933
MD5 3911e099bed114b7417378e2dbe079d1
SHA1 00fea996bbff2b686a0b3e275d536babacefc0af
SHA512 55630fbf32fb702185fbc3f6adee9f5775e6e91c0c1bf9e448d7506ebed15852970946d856d9dd399f0b12da3f0a97a05c6c2803a4546e8a034e8f89eeb3694b
SSDEEP 12288:7EELYhiWgZlgyCGYRe6v/M1Kx5pPKYcfzvw:oEskWgDDyb01I5pPKvfr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

formbook lokibot dn03 collection execution rat spyware stealer trojan

Malware Config

Extracted

Family

lokibot

http://45.61.137.215/index.php/3b1tenbkyj
http://kbfvzoboss.bid/alien/fre.php
http://alphastand.trade/alien/fre.php
http://alphastand.win/alien/fre.php
http://alphastand.top/alien/fre.php

Extracted

Family

formbook

Version

Campaign

dn03

Decoy

almouranipainting.com
cataloguia.shop
zaparielectric.com
whcqsc.com
ioco.in
aduredmond.com
vavada611a.fun
humtivers.com
jewellerytml.com
mcapitalparticipacoes.com
inhlcq.shop
solanamall.xyz
moviepropgroup.com
thegenesis.ltd
cyberxdefend.com
skinbykoco.com
entermintlead.com
honestaireviews.com
wyclhj7gqfustzp.buzz
w937xb.com
bakuusa.online
sabong-web.com
52cg2.club
jasonnutter.golf
odbet555.app
vipmotoryatkiralama.com
auravibeslighting.com
pulsesautos.com
imdcaam.com
vivaness.club
bovverbadges.com
giaydonghai.online
aditi-jobs.com
numericalsemantics.com
shoprazorlaser.com
lovedacademy.com
gets-lnds.io
teyo293.xyz
banditsolana.com
delivery-jobs-76134.bond
ppp5716.buzz
zjmeterial.com
de-ponqk.top
bntyr76rhg.top
servicepmgtl.world
nailtimelocust.top
paperappa.com
80sos.com
daysofbetting.com
slaytheday.fun
travauxdefou.com
bx2zyg.com
thecoxnews.com
qriskaq.com
top-dao.com
krstockly1.shop
roiwholesale.com
pajero777ads.click
twistedrubytx.com
thesovreignkingdomofmaui.info
cataclysmicgamingapparel.com
verxop.xyz
xn--kwra1023b.com
winterclairee.com
sukhiclothing.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook
Lokibot
Lokibot is a Password and CryptoCoin Wallet Stealer.
trojan spyware stealer lokibot

Formbook payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/4904-99-0x0000000000400000-0x000000000042F000-memory.dmp	formbook
behavioral2/memory/4260-132-0x0000000000A00000-0x0000000000A2F000-memory.dmp	formbook

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3632	powershell.exe
4784	powershell.exe

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	LMZ0324051754536245.PDF.bin.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	gJUOIrUR6kc2sEM.exe

Executes dropped EXE 1 IoCs

pid	Process
1540	gJUOIrUR6kc2sEM.exe

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook	RegSvcs.exe
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RegSvcs.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2916 set thread context of 744	2916	LMZ0324051754536245.PDF.bin.exe	101
PID 1540 set thread context of 4904	1540	gJUOIrUR6kc2sEM.exe	105
PID 4904 set thread context of 3440	4904	RegSvcs.exe	55
PID 4260 set thread context of 3440	4260	mstsc.exe	55

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
3632	powershell.exe
3632	powershell.exe
2916	LMZ0324051754536245.PDF.bin.exe
2916	LMZ0324051754536245.PDF.bin.exe
1540	gJUOIrUR6kc2sEM.exe
1540	gJUOIrUR6kc2sEM.exe
4904	RegSvcs.exe
4904	RegSvcs.exe
4904	RegSvcs.exe
4904	RegSvcs.exe
4784	powershell.exe
4784	powershell.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe
4260	mstsc.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
4904	RegSvcs.exe
4904	RegSvcs.exe
4904	RegSvcs.exe
4260	mstsc.exe
4260	mstsc.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeDebugPrivilege	2916	LMZ0324051754536245.PDF.bin.exe
Token: SeDebugPrivilege	3632	powershell.exe
Token: SeDebugPrivilege	744	RegSvcs.exe
Token: SeDebugPrivilege	1540	gJUOIrUR6kc2sEM.exe
Token: SeDebugPrivilege	4904	RegSvcs.exe
Token: SeDebugPrivilege	4784	powershell.exe
Token: SeShutdownPrivilege	3440	Explorer.EXE
Token: SeCreatePagefilePrivilege	3440	Explorer.EXE
Token: SeDebugPrivilege	4260	mstsc.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3440	Explorer.EXE

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 3632	2916	LMZ0324051754536245.PDF.bin.exe	97
PID 2916 wrote to memory of 3632	2916	LMZ0324051754536245.PDF.bin.exe	97
PID 2916 wrote to memory of 3632	2916	LMZ0324051754536245.PDF.bin.exe	97
PID 2916 wrote to memory of 1540	2916	LMZ0324051754536245.PDF.bin.exe	99
PID 2916 wrote to memory of 1540	2916	LMZ0324051754536245.PDF.bin.exe	99
PID 2916 wrote to memory of 1540	2916	LMZ0324051754536245.PDF.bin.exe	99
PID 2916 wrote to memory of 3972	2916	LMZ0324051754536245.PDF.bin.exe	100
PID 2916 wrote to memory of 3972	2916	LMZ0324051754536245.PDF.bin.exe	100
PID 2916 wrote to memory of 3972	2916	LMZ0324051754536245.PDF.bin.exe	100
PID 2916 wrote to memory of 744	2916	LMZ0324051754536245.PDF.bin.exe	101
PID 2916 wrote to memory of 744	2916	LMZ0324051754536245.PDF.bin.exe	101
PID 2916 wrote to memory of 744	2916	LMZ0324051754536245.PDF.bin.exe	101
PID 2916 wrote to memory of 744	2916	LMZ0324051754536245.PDF.bin.exe	101
PID 2916 wrote to memory of 744	2916	LMZ0324051754536245.PDF.bin.exe	101
PID 2916 wrote to memory of 744	2916	LMZ0324051754536245.PDF.bin.exe	101
PID 2916 wrote to memory of 744	2916	LMZ0324051754536245.PDF.bin.exe	101
PID 2916 wrote to memory of 744	2916	LMZ0324051754536245.PDF.bin.exe	101
PID 2916 wrote to memory of 744	2916	LMZ0324051754536245.PDF.bin.exe	101
PID 1540 wrote to memory of 4784	1540	gJUOIrUR6kc2sEM.exe	102
PID 1540 wrote to memory of 4784	1540	gJUOIrUR6kc2sEM.exe	102
PID 1540 wrote to memory of 4784	1540	gJUOIrUR6kc2sEM.exe	102
PID 1540 wrote to memory of 5088	1540	gJUOIrUR6kc2sEM.exe	104
PID 1540 wrote to memory of 5088	1540	gJUOIrUR6kc2sEM.exe	104
PID 1540 wrote to memory of 5088	1540	gJUOIrUR6kc2sEM.exe	104
PID 1540 wrote to memory of 4904	1540	gJUOIrUR6kc2sEM.exe	105
PID 1540 wrote to memory of 4904	1540	gJUOIrUR6kc2sEM.exe	105
PID 1540 wrote to memory of 4904	1540	gJUOIrUR6kc2sEM.exe	105
PID 1540 wrote to memory of 4904	1540	gJUOIrUR6kc2sEM.exe	105
PID 1540 wrote to memory of 4904	1540	gJUOIrUR6kc2sEM.exe	105
PID 1540 wrote to memory of 4904	1540	gJUOIrUR6kc2sEM.exe	105
PID 3440 wrote to memory of 4260	3440	Explorer.EXE	106
PID 3440 wrote to memory of 4260	3440	Explorer.EXE	106
PID 3440 wrote to memory of 4260	3440	Explorer.EXE	106
PID 4260 wrote to memory of 1720	4260	mstsc.exe	107
PID 4260 wrote to memory of 1720	4260	mstsc.exe	107
PID 4260 wrote to memory of 1720	4260	mstsc.exe	107

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	RegSvcs.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	RegSvcs.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Users\Admin\AppData\Local\Temp\LMZ0324051754536245.PDF.bin.exe
  "C:\Users\Admin\AppData\Local\Temp\LMZ0324051754536245.PDF.bin.exe"
  2⤵
  - Checks computer location settings
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\LMZ0324051754536245.PDF.bin.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3632
- - C:\Users\Admin\AppData\Local\Temp\gJUOIrUR6kc2sEM.exe
    "C:\Users\Admin\AppData\Local\Temp\gJUOIrUR6kc2sEM.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1540
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\gJUOIrUR6kc2sEM.exe"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4784
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      PID:5088
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      4⤵
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      Suspicious use of AdjustPrivilegeToken
      PID:4904
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:3972
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Accesses Microsoft Outlook profiles
    - Suspicious use of AdjustPrivilegeToken
    - outlook_office_path
    - outlook_win_path
    PID:744
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\SysWOW64\mstsc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4260
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 96bbe1d2b878b56a451116d03712f68ef5dad23944f986b91d4060a26a28e941
MD5 1c1e3062379b594d945993a1c542865b
SHA1 d1aed8e27c767ee79b02969b771f548186580695
SHA512 e0e19223c09527c9020ad9ff9920718e46622a9b8c41f0bbc4a3bb185c09eb80a6d5a3ab7013967917b357e15651ea62b9cb8d3ca8a00c1cc3afac06e45b2d36
SSDEEP 384:Vsf+BG9i+xuD1BiNauk+o9o2TYnK6seYLME/N03SoZyfYSgcjEDkyQ0gdEtkKhD:KfBuBoojo2TYnNgrWSlWCED/Ce3
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_xpkdspfo.eym.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xpkdspfo.eym.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

gJUOIrUR6kc2sEM.exe

Path C:\Users\Admin\AppData\Local\Temp\gJUOIrUR6kc2sEM.exe
Size 615KB
SHA256 8ef8e3afba42a19e43c2cb6f591ad6ef601791db37b5626f6102e6c4d39667b7
MD5 9fb018d34d80db3b22e721e2768f6bb5
SHA1 bba13f32dc03ba024b55a76e92137dec699640cc
SHA512 7f8a28f648b48bbbabdb7c7d78329fe821a11a54b40ed921be460c9875ba02307535cb0847dcf055497978e360f754083b67bc18877c6d6f2cb6b34aa1b3c2a2
SSDEEP 12288:u7gn06G1PFB897MDygmTpOAfTCts1tsLFZT/maWYw6EnKnqcgaogPkUhlQlbnm3q:u7u074JMDygmTpO7UyLvNvXJ9PkUhlOQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

0f5007522459c86e95ffcc62f32308f1_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1337824034-2731376981-3755436523-1000\0f5007522459c86e95ffcc62f32308f1_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f
Size 46B
SHA256 878f32f76b159494f5a39f9321616c6068cdb82e88df89bcc739bbc1ea78e1f9
MD5 d898504a722bff1524134c6ab6a5eaa5
SHA1 e0fdc90c2ca2a0219c99d2758e68c18875a3e11e
SHA512 26a4398bffb0c0aef9a6ec53cd3367a2d0abf2f70097f711bbbf1e9e32fd9f1a72121691bb6a39eeb55d596edd527934e541b4defb3b1426b1d1a6429804dc61
MD5 SHA1 SHA512

Submit Download

0f5007522459c86e95ffcc62f32308f1_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f

Path C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-1337824034-2731376981-3755436523-1000\0f5007522459c86e95ffcc62f32308f1_6833eb7b-8d4b-4cdd-9502-9bbf7fc1cf9f
Size 46B
SHA256 8c136c7ae08020ad16fd1928e36ad335ddef8b85906d66b712fff049aa57dc9a
MD5 c07225d4e7d01d31042965f048728a0a
SHA1 69d70b340fd9f44c89adb9a2278df84faa9906b7
SHA512 23d3cea738e1abf561320847c39dadc8b5794d7bd8761b0457956f827a17ad2556118b909a3e6929db79980ccf156a6f58ac823cf88329e62417d2807b34b64b
MD5 SHA1 SHA512

Submit Download

memory/744-48-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/744-43-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/744-146-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/744-47-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/744-96-0x0000000000400000-0x00000000004A2000-memory.dmp

Download

memory/1540-98-0x0000000006DE0000-0x0000000006E56000-memory.dmp

Download

memory/1540-44-0x0000000000AB0000-0x0000000000B50000-memory.dmp

Download

memory/1540-42-0x00000000751F0000-0x00000000759A0000-memory.dmp

Download

memory/1540-50-0x0000000005870000-0x0000000005904000-memory.dmp

Download

memory/1540-101-0x00000000751F0000-0x00000000759A0000-memory.dmp

Download

memory/2916-10-0x0000000008C10000-0x0000000008CAC000-memory.dmp

Download

memory/2916-0-0x00000000751FE000-0x00000000751FF000-memory.dmp

Download

memory/2916-1-0x00000000004D0000-0x0000000000558000-memory.dmp

Download

memory/2916-2-0x0000000005420000-0x00000000059C4000-memory.dmp

Download

memory/2916-3-0x0000000004F50000-0x0000000004FE2000-memory.dmp

Download

memory/2916-4-0x00000000050E0000-0x00000000050EA000-memory.dmp

Download

memory/2916-9-0x0000000006310000-0x0000000006372000-memory.dmp

Download

memory/2916-8-0x00000000052E0000-0x00000000052F0000-memory.dmp

Download

memory/2916-7-0x0000000006630000-0x000000000664A000-memory.dmp

Download

memory/2916-6-0x00000000065B0000-0x000000000662C000-memory.dmp

Download

memory/2916-5-0x00000000751F0000-0x00000000759A0000-memory.dmp

Download

memory/2916-49-0x00000000751F0000-0x00000000759A0000-memory.dmp

Download

memory/3440-136-0x00000000090A0000-0x00000000091FC000-memory.dmp

Download

memory/3632-17-0x00000000751F0000-0x00000000759A0000-memory.dmp

Download

memory/3632-28-0x0000000005B80000-0x0000000005ED4000-memory.dmp

Download

memory/3632-52-0x000000006FE50000-0x000000006FE9C000-memory.dmp

Download

memory/3632-51-0x0000000007150000-0x0000000007182000-memory.dmp

Download

memory/3632-62-0x0000000006770000-0x000000000678E000-memory.dmp

Download

memory/3632-63-0x0000000007190000-0x0000000007233000-memory.dmp

Download

memory/3632-67-0x0000000007B10000-0x000000000818A000-memory.dmp

Download

memory/3632-68-0x00000000074C0000-0x00000000074DA000-memory.dmp

Download

memory/3632-69-0x0000000007530000-0x000000000753A000-memory.dmp

Download

memory/3632-70-0x0000000007740000-0x00000000077D6000-memory.dmp

Download

memory/3632-71-0x00000000076C0000-0x00000000076D1000-memory.dmp

Download

memory/3632-72-0x00000000076F0000-0x00000000076FE000-memory.dmp

Download

memory/3632-73-0x0000000007700000-0x0000000007714000-memory.dmp

Download

memory/3632-74-0x0000000007800000-0x000000000781A000-memory.dmp

Download

memory/3632-75-0x00000000077E0000-0x00000000077E8000-memory.dmp

Download

memory/3632-78-0x00000000751F0000-0x00000000759A0000-memory.dmp

Download

memory/3632-37-0x00000000061A0000-0x00000000061BE000-memory.dmp

Download

memory/3632-38-0x00000000061D0000-0x000000000621C000-memory.dmp

Download

memory/3632-23-0x00000000751F0000-0x00000000759A0000-memory.dmp

Download

memory/3632-16-0x0000000005A00000-0x0000000005A66000-memory.dmp

Download

memory/3632-11-0x0000000004BF0000-0x0000000004C26000-memory.dmp

Download

memory/3632-14-0x00000000051C0000-0x00000000051E2000-memory.dmp

Download

memory/3632-15-0x0000000005990000-0x00000000059F6000-memory.dmp

Download

memory/3632-12-0x00000000751F0000-0x00000000759A0000-memory.dmp

Download

memory/3632-13-0x0000000005260000-0x0000000005888000-memory.dmp

Download

memory/4260-130-0x0000000000390000-0x00000000004CA000-memory.dmp

Download

memory/4260-131-0x0000000000390000-0x00000000004CA000-memory.dmp

Download

memory/4260-132-0x0000000000A00000-0x0000000000A2F000-memory.dmp

Download

memory/4784-115-0x0000000005CF0000-0x0000000005D3C000-memory.dmp

Download

memory/4784-116-0x00000000720F0000-0x000000007213C000-memory.dmp

Download

memory/4784-126-0x0000000006D90000-0x0000000006E33000-memory.dmp

Download

memory/4784-127-0x0000000007300000-0x0000000007311000-memory.dmp

Download

memory/4784-128-0x0000000007340000-0x0000000007354000-memory.dmp

Download

memory/4784-109-0x0000000005750000-0x0000000005AA4000-memory.dmp

Download

memory/4904-99-0x0000000000400000-0x000000000042F000-memory.dmp

Download