formbook | 4be616041ed326d07a5d65824ca71501c90efdaee9ebbd2693b236140e967dd4

Analysis

max time kernel
149s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
BonificoSct_20_07_2026_09_07_09.js
Size 5.8MB
Sample260724-p4js5sem61
SHA256 4be616041ed326d07a5d65824ca71501c90efdaee9ebbd2693b236140e967dd4
MD5 152f338ab8622ef31427c300d7f1e4e7
SHA1 291063e41eab884c3e026cbff89dfcd240b6230f
SHA512 a0a58b2faf6889c3935ed578edbfb80a82b066b9e98e73db0f5604dea64ec3e8b23320830279e8461d7d58f07088b29a3b6b22b73b3cefaa15accb61411a257c
SSDEEP 49152:v8KSj4SnxbP4TwI/R6y0G51NXa3G7g4+KVyC3dPTavt3OwLOwJ8KSj4SnxbP4Tw+:a
TLSH
T15E562CB2B5EF7A026F15A75D940D3A450F6FE1744EE263DCD09706D4E88B48E28A04EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection defense_evasion discovery execution formbook rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 6 IoCs

rat

resource	yara_rule
behavioral2/memory/3596-26-0x0000000000F40000-0x0000000000F86000-memory.dmp	family_formbook
behavioral2/memory/3596-31-0x0000000000F40000-0x0000000000F86000-memory.dmp	family_formbook
behavioral2/memory/3596-30-0x0000000000F40000-0x0000000000F86000-memory.dmp	family_formbook
behavioral2/memory/3596-37-0x0000000000F40000-0x0000000000F86000-memory.dmp	family_formbook
behavioral2/memory/5348-39-0x0000000001290000-0x00000000012D3000-memory.dmp	family_formbook
behavioral2/memory/5348-43-0x0000000001290000-0x00000000012D3000-memory.dmp	family_formbook

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	3416	wscript.exe
11	3416	wscript.exe
11	3416	wscript.exe
11	3416	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2492	powershell.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	icsunattend.exe

Suspicious use of SetThreadContext 20 IoCs

description	pid	Process	procid_target
PID 2492 set thread context of 3596	2492	powershell.exe	95
PID 3596 set thread context of 3416	3596	aspnet_compiler.exe	86
PID 3596 set thread context of 5348	3596	aspnet_compiler.exe	96
PID 2492 set thread context of 2328	2492	powershell.exe	97
PID 5348 set thread context of 3416	5348	icsunattend.exe	86
PID 2492 set thread context of 2984	2492	powershell.exe	99
PID 2492 set thread context of 5364	2492	powershell.exe	100
PID 2492 set thread context of 5844	2492	powershell.exe	102
PID 5348 set thread context of 992	5348	icsunattend.exe	101
PID 2492 set thread context of 3696	2492	powershell.exe	103
PID 2492 set thread context of 580	2492	powershell.exe	104
PID 2492 set thread context of 3456	2492	powershell.exe	105
PID 2492 set thread context of 3404	2492	powershell.exe	106
PID 2492 set thread context of 3508	2492	powershell.exe	107
PID 2492 set thread context of 5860	2492	powershell.exe	108
PID 2492 set thread context of 4540	2492	powershell.exe	111
PID 2492 set thread context of 3952	2492	powershell.exe	112
PID 2492 set thread context of 2720	2492	powershell.exe	113
PID 2492 set thread context of 5736	2492	powershell.exe	114
PID 2492 set thread context of 2592	2492	powershell.exe	115

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icsunattend.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
1228	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-2246396966-3025826688-3847171515-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	icsunattend.exe

Suspicious behavior: EnumeratesProcesses 58 IoCs

pid	Process
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
3596	aspnet_compiler.exe
3596	aspnet_compiler.exe
3596	aspnet_compiler.exe
3596	aspnet_compiler.exe
2492	powershell.exe
5348	icsunattend.exe
5348	icsunattend.exe
5348	icsunattend.exe
5348	icsunattend.exe
2492	powershell.exe
2328	aspnet_compiler.exe
2492	powershell.exe
2984	aspnet_compiler.exe
2492	powershell.exe
5364	aspnet_compiler.exe
2492	powershell.exe
5844	aspnet_compiler.exe
2492	powershell.exe
3696	aspnet_compiler.exe
2492	powershell.exe
580	aspnet_compiler.exe
2492	powershell.exe
3456	aspnet_compiler.exe
2492	powershell.exe
3404	aspnet_compiler.exe
2492	powershell.exe
3508	aspnet_compiler.exe
2492	powershell.exe
5860	aspnet_compiler.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
4540	aspnet_compiler.exe
2492	powershell.exe
3952	aspnet_compiler.exe
2492	powershell.exe
2720	aspnet_compiler.exe
2492	powershell.exe
5736	aspnet_compiler.exe
2492	powershell.exe
2592	aspnet_compiler.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
3596	aspnet_compiler.exe
3416	wscript.exe
3416	wscript.exe
5348	icsunattend.exe
5348	icsunattend.exe
5348	icsunattend.exe
5348	icsunattend.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2492	powershell.exe
Token: SeDebugPrivilege	1228	taskkill.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 3416 wrote to memory of 2492	3416	wscript.exe	88
PID 2492 wrote to memory of 1688	2492	powershell.exe	90
PID 2492 wrote to memory of 5624	2492	powershell.exe	91
PID 2492 wrote to memory of 4896	2492	powershell.exe	92
PID 2492 wrote to memory of 2560	2492	powershell.exe	93
PID 2492 wrote to memory of 3556	2492	powershell.exe	94
PID 2492 wrote to memory of 3596	2492	powershell.exe	95
PID 2492 wrote to memory of 3596	2492	powershell.exe	95
PID 2492 wrote to memory of 3596	2492	powershell.exe	95
PID 3416 wrote to memory of 5348	3416	wscript.exe	96
PID 2492 wrote to memory of 2328	2492	powershell.exe	97
PID 2492 wrote to memory of 2328	2492	powershell.exe	97
PID 2492 wrote to memory of 2328	2492	powershell.exe	97
PID 2492 wrote to memory of 2984	2492	powershell.exe	99
PID 2492 wrote to memory of 2984	2492	powershell.exe	99
PID 2492 wrote to memory of 2984	2492	powershell.exe	99
PID 2492 wrote to memory of 5364	2492	powershell.exe	100
PID 2492 wrote to memory of 5364	2492	powershell.exe	100
PID 2492 wrote to memory of 5364	2492	powershell.exe	100
PID 5348 wrote to memory of 992	5348	icsunattend.exe	101
PID 2492 wrote to memory of 5844	2492	powershell.exe	102
PID 2492 wrote to memory of 5844	2492	powershell.exe	102
PID 2492 wrote to memory of 5844	2492	powershell.exe	102
PID 2492 wrote to memory of 3696	2492	powershell.exe	103
PID 2492 wrote to memory of 3696	2492	powershell.exe	103
PID 2492 wrote to memory of 3696	2492	powershell.exe	103
PID 2492 wrote to memory of 580	2492	powershell.exe	104
PID 2492 wrote to memory of 580	2492	powershell.exe	104
PID 2492 wrote to memory of 580	2492	powershell.exe	104
PID 2492 wrote to memory of 3456	2492	powershell.exe	105
PID 2492 wrote to memory of 3456	2492	powershell.exe	105
PID 2492 wrote to memory of 3456	2492	powershell.exe	105
PID 2492 wrote to memory of 3404	2492	powershell.exe	106
PID 2492 wrote to memory of 3404	2492	powershell.exe	106
PID 2492 wrote to memory of 3404	2492	powershell.exe	106
PID 2492 wrote to memory of 3508	2492	powershell.exe	107
PID 2492 wrote to memory of 3508	2492	powershell.exe	107
PID 2492 wrote to memory of 3508	2492	powershell.exe	107
PID 2492 wrote to memory of 5860	2492	powershell.exe	108
PID 2492 wrote to memory of 5860	2492	powershell.exe	108
PID 2492 wrote to memory of 5860	2492	powershell.exe	108
PID 2492 wrote to memory of 712	2492	powershell.exe	109
PID 2492 wrote to memory of 2304	2492	powershell.exe	110
PID 2492 wrote to memory of 4540	2492	powershell.exe	111
PID 2492 wrote to memory of 4540	2492	powershell.exe	111
PID 2492 wrote to memory of 4540	2492	powershell.exe	111
PID 2492 wrote to memory of 3952	2492	powershell.exe	112
PID 2492 wrote to memory of 3952	2492	powershell.exe	112
PID 2492 wrote to memory of 3952	2492	powershell.exe	112
PID 2492 wrote to memory of 2720	2492	powershell.exe	113
PID 2492 wrote to memory of 2720	2492	powershell.exe	113
PID 2492 wrote to memory of 2720	2492	powershell.exe	113
PID 2492 wrote to memory of 5736	2492	powershell.exe	114
PID 2492 wrote to memory of 5736	2492	powershell.exe	114
PID 2492 wrote to memory of 5736	2492	powershell.exe	114
PID 2492 wrote to memory of 2592	2492	powershell.exe	115
PID 2492 wrote to memory of 2592	2492	powershell.exe	115
PID 2492 wrote to memory of 2592	2492	powershell.exe	115
PID 3416 wrote to memory of 1228	3416	wscript.exe	117

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	icsunattend.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\BonificoSct_20_07_2026_09_07_09.js
1⤵
- Badlisted process makes network request
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3416
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -ExecutionPolicy Bypass -NoProfile -WindowStyle Hidden -File "C:\Temp\ps_GEiMRUC5vbjv_1784897586212.ps1"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:1688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:5624
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:4896
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2560
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:3556
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3596
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2328
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2984
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5364
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5844
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3696
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:580
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3456
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3404
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3508
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5860
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:712
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    PID:2304
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4540
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3952
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2720
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5736
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2592
- C:\Windows\SysWOW64\icsunattend.exe
  "C:\Windows\SysWOW64\icsunattend.exe"
  2⤵
  - Accesses Microsoft Outlook profiles
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  - outlook_office_path
  PID:5348
- - C:\Program Files\Mozilla Firefox\Firefox.exe
    "C:\Program Files\Mozilla Firefox\Firefox.exe"
    3⤵
    PID:992
- C:\Windows\System32\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im wscript.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ps_GEiMRUC5vbjv_1784897586212.ps1

Path C:\Temp\ps_GEiMRUC5vbjv_1784897586212.ps1
Size 2.1MB
SHA256 2377a227db03f80b517c95363ce3ffa32373a406cfe304f72c7721699ed0b4de
MD5 a770b02ee8c7241e8f1d1c9f3619a400
SHA1 84133eb65072cf96200f5ead16ba6ee989db4309
SHA512 2ddfb36400d3b8f394da2e90bc22352086307cbe4af336fe7d384afae564203f3ae52c75efabadf0d16947233ce2759a254aa2ee0812ac72c7f09c8b891cd4f6
SSDEEP 24576:Tw0RkUNS02HGNpnEH508BlO54jdmNUv1kDyvSNKZjhnqDA+nz2dHwKpmS:E
TLSH
T1DAA586FB17280CF7869A715FCA95342E29E67F7D4B403A9F947196C02027728EC4739A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/992-53-0x0000021B82770000-0x0000021B8285F000-memory.dmp

Download

memory/2492-17-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/2492-66-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/2492-7-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/2492-5-0x0000028841AB0000-0x0000028841AD2000-memory.dmp

Download

memory/2492-19-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/2492-10-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/2492-11-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/2492-12-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/2492-13-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/2492-14-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/2492-15-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/2492-16-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/2492-6-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/2492-2-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/2492-9-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/2492-20-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/2492-21-0x0000028859FF0000-0x000002885A004000-memory.dmp

Download

memory/2492-23-0x000002885A010000-0x000002885A024000-memory.dmp

Download

memory/2492-1-0x00007FFD2973F000-0x00007FFD29740000-memory.dmp

Download

memory/2492-25-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/2492-56-0x000002885A080000-0x000002885A094000-memory.dmp

Download

memory/2492-27-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/2492-28-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/2492-18-0x00007FFD295B0000-0x00007FFD29F54000-memory.dmp

Download

memory/3416-67-0x0000016D1FD60000-0x0000016D1FE7A000-memory.dmp

Download

memory/3416-41-0x0000000000A10000-0x0000000000D27000-memory.dmp

Download

memory/3416-42-0x0000016D1FD60000-0x0000016D1FE7A000-memory.dmp

Download

memory/3416-33-0x0000000000A10000-0x0000000000D27000-memory.dmp

Download

memory/3596-24-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/3596-35-0x0000000000F40000-0x0000000000F86000-memory.dmp

Download

memory/3596-37-0x0000000000F40000-0x0000000000F86000-memory.dmp

Download

memory/3596-38-0x0000000001280000-0x00000000012A0000-memory.dmp

Download

memory/3596-30-0x0000000000F40000-0x0000000000F86000-memory.dmp

Download

memory/3596-32-0x0000000001280000-0x00000000012A0000-memory.dmp

Download

memory/3596-31-0x0000000000F40000-0x0000000000F86000-memory.dmp

Download

memory/3596-29-0x0000000001330000-0x00000000016A4000-memory.dmp

Download

memory/3596-26-0x0000000000F40000-0x0000000000F86000-memory.dmp

Download

memory/5348-36-0x0000000001290000-0x00000000012D3000-memory.dmp

Download

memory/5348-39-0x0000000001290000-0x00000000012D3000-memory.dmp

Download

memory/5348-34-0x0000000001290000-0x00000000012D3000-memory.dmp

Download

memory/5348-43-0x0000000001290000-0x00000000012D3000-memory.dmp

Download