formbook | e6452e1e6b5585d30df5d4e16921318ecbe4cc459ffcab51b41052a22de1a7c1

Analysis

max time kernel
149s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 13:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Swift 0006400000XXX.js
Size 2.0MB
Sample260709-qlft7sbt5p
SHA256 e6452e1e6b5585d30df5d4e16921318ecbe4cc459ffcab51b41052a22de1a7c1
MD5 25e13f519c12c64454d74206cd0cd3ef
SHA1 47aab841be63edb843632746013819e8b8349cf9
SHA512 4525d93584addd1d9c87c061b2844d9a379c9b5e7fdbdcfb8ed96848598b29fa7ae62e1e0f5068f55a19fe862aa6c6886722ee306b145d01660bedcb225c82a6
SSDEEP 24576:7EzX4qEy8/n07J6XcIJu9Vv7y7qsI0425TDE6nKk0LIV7hZe7OvSaj1h:7EzZ8PUJ6XM2+049eJeI
TLSH
T162A502008AC07FA8DFA95B2D90BE254DF3E0099F5556664AF723FC4AFFA790095071B8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection defense_evasion discovery execution formbook rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/3980-24-0x0000000001310000-0x0000000001356000-memory.dmp	family_formbook
behavioral2/memory/3980-26-0x0000000001310000-0x0000000001356000-memory.dmp	family_formbook
behavioral2/memory/3980-34-0x0000000001310000-0x0000000001356000-memory.dmp	family_formbook
behavioral2/memory/3376-35-0x0000000000440000-0x0000000000483000-memory.dmp	family_formbook

Badlisted process makes network request 12 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4144	wscript.exe
4	4144	wscript.exe
5	4144	wscript.exe
6	4144	wscript.exe
7	4144	wscript.exe
8	4144	wscript.exe
9	4144	wscript.exe
10	4144	wscript.exe
11	4144	wscript.exe
12	4144	wscript.exe
13	4144	wscript.exe
14	4144	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1544	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	mstsc.exe

Suspicious use of SetThreadContext 21 IoCs

description	pid	Process	procid_target
PID 1544 set thread context of 3980	1544	powershell.exe	95
PID 3980 set thread context of 4144	3980	aspnet_compiler.exe	87
PID 3980 set thread context of 3376	3980	aspnet_compiler.exe	96
PID 1544 set thread context of 2876	1544	powershell.exe	97
PID 3376 set thread context of 4144	3376	mstsc.exe	87
PID 1544 set thread context of 5020	1544	powershell.exe	98
PID 1544 set thread context of 3212	1544	powershell.exe	99
PID 1544 set thread context of 1356	1544	powershell.exe	102
PID 1544 set thread context of 2516	1544	powershell.exe	104
PID 3376 set thread context of 1184	3376	mstsc.exe	103
PID 1544 set thread context of 4940	1544	powershell.exe	105
PID 1544 set thread context of 2096	1544	powershell.exe	106
PID 1544 set thread context of 368	1544	powershell.exe	107
PID 1544 set thread context of 2136	1544	powershell.exe	108
PID 1544 set thread context of 4448	1544	powershell.exe	109
PID 1544 set thread context of 1360	1544	powershell.exe	111
PID 1544 set thread context of 1940	1544	powershell.exe	112
PID 1544 set thread context of 5840	1544	powershell.exe	117
PID 1544 set thread context of 3536	1544	powershell.exe	119
PID 1544 set thread context of 4272	1544	powershell.exe	121
PID 1544 set thread context of 1572	1544	powershell.exe	122

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mstsc.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1704	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2699128254-3633964024-152949075-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	mstsc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
3980	aspnet_compiler.exe
3980	aspnet_compiler.exe
3980	aspnet_compiler.exe
3980	aspnet_compiler.exe
1544	powershell.exe
3376	mstsc.exe
3376	mstsc.exe
3376	mstsc.exe
3376	mstsc.exe
1544	powershell.exe
2876	aspnet_compiler.exe
1544	powershell.exe
5020	aspnet_compiler.exe
1544	powershell.exe
3212	aspnet_compiler.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1356	aspnet_compiler.exe
1544	powershell.exe
2516	aspnet_compiler.exe
1544	powershell.exe
4940	aspnet_compiler.exe
1544	powershell.exe
2096	aspnet_compiler.exe
1544	powershell.exe
368	aspnet_compiler.exe
1544	powershell.exe
2136	aspnet_compiler.exe
1544	powershell.exe
4448	aspnet_compiler.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1360	aspnet_compiler.exe
1544	powershell.exe
1940	aspnet_compiler.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe
5840	aspnet_compiler.exe
1544	powershell.exe
1544	powershell.exe
1544	powershell.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
3980	aspnet_compiler.exe
4144	wscript.exe
4144	wscript.exe
3376	mstsc.exe
3376	mstsc.exe
3376	mstsc.exe
3376	mstsc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1544	powershell.exe
Token: SeDebugPrivilege	1704	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4144 wrote to memory of 1544	4144	wscript.exe	88
PID 1544 wrote to memory of 5372	1544	powershell.exe	90
PID 1544 wrote to memory of 5520	1544	powershell.exe	91
PID 1544 wrote to memory of 868	1544	powershell.exe	92
PID 1544 wrote to memory of 1088	1544	powershell.exe	93
PID 1544 wrote to memory of 5948	1544	powershell.exe	94
PID 1544 wrote to memory of 3980	1544	powershell.exe	95
PID 1544 wrote to memory of 3980	1544	powershell.exe	95
PID 1544 wrote to memory of 3980	1544	powershell.exe	95
PID 4144 wrote to memory of 3376	4144	wscript.exe	96
PID 1544 wrote to memory of 2876	1544	powershell.exe	97
PID 1544 wrote to memory of 2876	1544	powershell.exe	97
PID 1544 wrote to memory of 2876	1544	powershell.exe	97
PID 1544 wrote to memory of 5020	1544	powershell.exe	98
PID 1544 wrote to memory of 5020	1544	powershell.exe	98
PID 1544 wrote to memory of 5020	1544	powershell.exe	98
PID 1544 wrote to memory of 3212	1544	powershell.exe	99
PID 1544 wrote to memory of 3212	1544	powershell.exe	99
PID 1544 wrote to memory of 3212	1544	powershell.exe	99
PID 1544 wrote to memory of 3548	1544	powershell.exe	101
PID 1544 wrote to memory of 1356	1544	powershell.exe	102
PID 1544 wrote to memory of 1356	1544	powershell.exe	102
PID 1544 wrote to memory of 1356	1544	powershell.exe	102
PID 3376 wrote to memory of 1184	3376	mstsc.exe	103
PID 1544 wrote to memory of 2516	1544	powershell.exe	104
PID 1544 wrote to memory of 2516	1544	powershell.exe	104
PID 1544 wrote to memory of 2516	1544	powershell.exe	104
PID 1544 wrote to memory of 4940	1544	powershell.exe	105
PID 1544 wrote to memory of 4940	1544	powershell.exe	105
PID 1544 wrote to memory of 4940	1544	powershell.exe	105
PID 1544 wrote to memory of 2096	1544	powershell.exe	106
PID 1544 wrote to memory of 2096	1544	powershell.exe	106
PID 1544 wrote to memory of 2096	1544	powershell.exe	106
PID 1544 wrote to memory of 368	1544	powershell.exe	107
PID 1544 wrote to memory of 368	1544	powershell.exe	107
PID 1544 wrote to memory of 368	1544	powershell.exe	107
PID 1544 wrote to memory of 2136	1544	powershell.exe	108
PID 1544 wrote to memory of 2136	1544	powershell.exe	108
PID 1544 wrote to memory of 2136	1544	powershell.exe	108
PID 1544 wrote to memory of 4448	1544	powershell.exe	109
PID 1544 wrote to memory of 4448	1544	powershell.exe	109
PID 1544 wrote to memory of 4448	1544	powershell.exe	109
PID 1544 wrote to memory of 2708	1544	powershell.exe	110
PID 1544 wrote to memory of 1360	1544	powershell.exe	111
PID 1544 wrote to memory of 1360	1544	powershell.exe	111
PID 1544 wrote to memory of 1360	1544	powershell.exe	111
PID 1544 wrote to memory of 1940	1544	powershell.exe	112
PID 1544 wrote to memory of 1940	1544	powershell.exe	112
PID 1544 wrote to memory of 1940	1544	powershell.exe	112
PID 1544 wrote to memory of 4992	1544	powershell.exe	113
PID 1544 wrote to memory of 3004	1544	powershell.exe	114
PID 1544 wrote to memory of 2464	1544	powershell.exe	115
PID 1544 wrote to memory of 5664	1544	powershell.exe	116
PID 1544 wrote to memory of 5840	1544	powershell.exe	117
PID 1544 wrote to memory of 5840	1544	powershell.exe	117
PID 1544 wrote to memory of 5840	1544	powershell.exe	117
PID 1544 wrote to memory of 1240	1544	powershell.exe	118
PID 1544 wrote to memory of 3536	1544	powershell.exe	119
PID 1544 wrote to memory of 3536	1544	powershell.exe	119
PID 1544 wrote to memory of 3536	1544	powershell.exe	119
PID 1544 wrote to memory of 4268	1544	powershell.exe	120
PID 1544 wrote to memory of 4272	1544	powershell.exe	121
PID 1544 wrote to memory of 4272	1544	powershell.exe	121
PID 1544 wrote to memory of 4272	1544	powershell.exe	121

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-2699128254-3633964024-152949075-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	mstsc.exe

C:\Windows\system32\wscript.exe
wscript.exe "C:\Users\Admin\AppData\Local\Temp\Swift 0006400000XXX.js"
1⤵
- Badlisted process makes network request
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\script_Qt3LySWz7MQf_1783603248168.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1544
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5372
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5520
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:868
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1088
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5948
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3980
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2876
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5020
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3212
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3548
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1356
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2516
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4940
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2096
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:368
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2136
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4448
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2708
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1360
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1940
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4992
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3004
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2464
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5664
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5840
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1240
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3536
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4268
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4272
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1572
- C:\Windows\SysWOW64\mstsc.exe
  "C:\Windows\SysWOW64\mstsc.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:3376
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:1184
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im wscript.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

script_Qt3LySWz7MQf_1783603248168.ps1

Path C:\Temp\script_Qt3LySWz7MQf_1783603248168.ps1
Size 1.4MB
SHA256 e390ffd15f0539ebe60b45429df246f5d21dd95b3b006a98e3b2d3fd9f5d58aa
MD5 0ef57a23192d72507d9b3ade1dae03e0
SHA1 6fbcf6bfc6fe19a93348c7aaea514df69548cc99
SHA512 a195b6ad1e2c55f74b48e151d0401a9b1e5e4e51fb5dd4ea013d0d16bc2884a115ddded27e07548defa904c43be0b80ca2feb65d99dd93212cf1c32f2bcf1bac
SSDEEP 24576:WGOxnJZZ8ic1T2eDB882h7mOjo3keXdGaC8mtJuHHuRBMmz+esCi0y0A:aFcRfy7m+KxGHiG+fH
TLSH
T1576533223FDA7EF246AFC11B202B7F8E3AD11415A00B29DBE7D9144B1958258C79B94E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1184-51-0x00000281F0770000-0x00000281F0891000-memory.dmp

Download

memory/1544-21-0x000001E2406D0000-0x000001E2406E4000-memory.dmp

Download

memory/1544-18-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/1544-5-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/1544-8-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/1544-9-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/1544-63-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/1544-11-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/1544-12-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/1544-13-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/1544-14-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/1544-15-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/1544-16-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/1544-17-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/1544-32-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/1544-19-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/1544-20-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/1544-1-0x00007FF8D1A8F000-0x00007FF8D1A90000-memory.dmp

Download

memory/1544-22-0x000001E240710000-0x000001E240724000-memory.dmp

Download

memory/1544-6-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/1544-4-0x000001E2406E0000-0x000001E240702000-memory.dmp

Download

memory/1544-10-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/1544-40-0x000001E2409A0000-0x000001E2409B4000-memory.dmp

Download

memory/1544-36-0x000001E240790000-0x000001E2407A4000-memory.dmp

Download

memory/1544-28-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/1544-29-0x00007FF8D1900000-0x00007FF8D22A4000-memory.dmp

Download

memory/3376-31-0x0000000000440000-0x0000000000483000-memory.dmp

Download

memory/3376-35-0x0000000000440000-0x0000000000483000-memory.dmp

Download

memory/3980-24-0x0000000001310000-0x0000000001356000-memory.dmp

Download

memory/3980-34-0x0000000001310000-0x0000000001356000-memory.dmp

Download

memory/3980-33-0x0000000001310000-0x0000000001356000-memory.dmp

Download

memory/3980-26-0x0000000001310000-0x0000000001356000-memory.dmp

Download

memory/3980-23-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3980-25-0x00000000016F0000-0x0000000001A64000-memory.dmp

Download

memory/4144-27-0x0000000000BD0000-0x0000000002091000-memory.dmp

Download

memory/4144-38-0x0000000000BD0000-0x0000000002091000-memory.dmp

Download

memory/4144-39-0x000001809E840000-0x000001809E900000-memory.dmp

Download

memory/4144-64-0x000001809E840000-0x000001809E900000-memory.dmp

Download