formbook | 1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe
Size 1003KB
Sample260810-reqw9szglb
SHA256 1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029
MD5 3ec946c87a5bd89ad8b744a2dc9771a3
SHA1 235f368abd1a8396a14ddd6bb7e491fcc91211b6
SHA512 9ba0b7b4476e3f6978313c0c25003ac77f95afbce406319bf2126aa5c6d1d54d8e5c6406f7ef0d7b304e375e99afb55c3160bfadb53125d2bb9ca1ba4d0e5bcc
SSDEEP 24576:wJhdQAIYd24wqb4rve+Txeua059NFZ/dQ1lfL:wJhdFlLwqbGe+TIun9h0
TLSH
T156251298DE09CA12D9925BF46861F33E52715CCEDA04C3A7C9FD9EDF3C19B096C24982
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection discovery execution formbook persistence rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/120-28-0x0000000000AC0000-0x0000000000B06000-memory.dmp	family_formbook
behavioral2/memory/120-54-0x0000000000AC0000-0x0000000000B06000-memory.dmp	family_formbook
behavioral2/memory/1792-55-0x0000000000490000-0x00000000004D3000-memory.dmp	family_formbook

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4360	powershell.exe
2964	powershell.exe
6000	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
6016	fZGjWDcWCl.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	wusa.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\fZGjWDcWCl = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\5w3nncq21yy.ps1\""	1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe

SmartAssembly .NET packer 2 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/864-6-0x0000000005450000-0x0000000005466000-memory.dmp	SmartAssembly
behavioral2/memory/6016-47-0x0000000004F10000-0x0000000004F26000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 864 set thread context of 120	864	1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe	93
PID 120 set thread context of 5032	120	RegSvcs.exe
PID 120 set thread context of 1792	120	RegSvcs.exe	97
PID 1792 set thread context of 3692	1792	wusa.exe	81
PID 6016 set thread context of 780	6016	fZGjWDcWCl.exe	101
PID 1792 set thread context of 2488	1792	wusa.exe	104

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fZGjWDcWCl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wusa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1079202589-886135813-2527035092-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	wusa.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
864	1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe
864	1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe
864	1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe
864	1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe
864	1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe
864	1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe
4360	powershell.exe
120	RegSvcs.exe
4360	powershell.exe
120	RegSvcs.exe
120	RegSvcs.exe
120	RegSvcs.exe
6000	powershell.exe
6000	powershell.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
6016	fZGjWDcWCl.exe
6016	fZGjWDcWCl.exe
2964	powershell.exe
780	RegSvcs.exe
2964	powershell.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3692	explorer.exe

Suspicious behavior: MapViewOfSection 7 IoCs

pid	Process
120	RegSvcs.exe
5032	Process not Found
5032	Process not Found
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe
1792	wusa.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	864	1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe
Token: SeDebugPrivilege	4360	powershell.exe
Token: SeDebugPrivilege	6000	powershell.exe
Token: SeIncreaseQuotaPrivilege	4360	powershell.exe
Token: SeSecurityPrivilege	4360	powershell.exe
Token: SeTakeOwnershipPrivilege	4360	powershell.exe
Token: SeLoadDriverPrivilege	4360	powershell.exe
Token: SeSystemProfilePrivilege	4360	powershell.exe
Token: SeSystemtimePrivilege	4360	powershell.exe
Token: SeProfSingleProcessPrivilege	4360	powershell.exe
Token: SeIncBasePriorityPrivilege	4360	powershell.exe
Token: SeCreatePagefilePrivilege	4360	powershell.exe
Token: SeBackupPrivilege	4360	powershell.exe
Token: SeRestorePrivilege	4360	powershell.exe
Token: SeShutdownPrivilege	4360	powershell.exe
Token: SeDebugPrivilege	4360	powershell.exe
Token: SeSystemEnvironmentPrivilege	4360	powershell.exe
Token: SeRemoteShutdownPrivilege	4360	powershell.exe
Token: SeUndockPrivilege	4360	powershell.exe
Token: SeManageVolumePrivilege	4360	powershell.exe
Token: 33	4360	powershell.exe
Token: 34	4360	powershell.exe
Token: 35	4360	powershell.exe
Token: 36	4360	powershell.exe
Token: SeShutdownPrivilege	3692	explorer.exe
Token: SeCreatePagefilePrivilege	3692	explorer.exe
Token: SeDebugPrivilege	6016	fZGjWDcWCl.exe
Token: SeShutdownPrivilege	3692	explorer.exe
Token: SeCreatePagefilePrivilege	3692	explorer.exe
Token: SeShutdownPrivilege	3692	explorer.exe
Token: SeCreatePagefilePrivilege	3692	explorer.exe
Token: SeShutdownPrivilege	3692	explorer.exe
Token: SeCreatePagefilePrivilege	3692	explorer.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeIncreaseQuotaPrivilege	2964	powershell.exe
Token: SeSecurityPrivilege	2964	powershell.exe
Token: SeTakeOwnershipPrivilege	2964	powershell.exe
Token: SeLoadDriverPrivilege	2964	powershell.exe
Token: SeSystemProfilePrivilege	2964	powershell.exe
Token: SeSystemtimePrivilege	2964	powershell.exe
Token: SeProfSingleProcessPrivilege	2964	powershell.exe
Token: SeIncBasePriorityPrivilege	2964	powershell.exe
Token: SeCreatePagefilePrivilege	2964	powershell.exe
Token: SeBackupPrivilege	2964	powershell.exe
Token: SeRestorePrivilege	2964	powershell.exe
Token: SeShutdownPrivilege	2964	powershell.exe
Token: SeDebugPrivilege	2964	powershell.exe
Token: SeSystemEnvironmentPrivilege	2964	powershell.exe
Token: SeRemoteShutdownPrivilege	2964	powershell.exe
Token: SeUndockPrivilege	2964	powershell.exe
Token: SeManageVolumePrivilege	2964	powershell.exe
Token: 33	2964	powershell.exe
Token: 34	2964	powershell.exe
Token: 35	2964	powershell.exe
Token: 36	2964	powershell.exe
Token: SeShutdownPrivilege	3692	explorer.exe
Token: SeCreatePagefilePrivilege	3692	explorer.exe
Token: SeShutdownPrivilege	3692	explorer.exe
Token: SeCreatePagefilePrivilege	3692	explorer.exe
Token: SeShutdownPrivilege	3692	explorer.exe
Token: SeCreatePagefilePrivilege	3692	explorer.exe
Token: SeShutdownPrivilege	3692	explorer.exe
Token: SeCreatePagefilePrivilege	3692	explorer.exe
Token: SeShutdownPrivilege	3692	explorer.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 4360	864	1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe	89
PID 864 wrote to memory of 5640	864	1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe	91
PID 864 wrote to memory of 5628	864	1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe	92
PID 864 wrote to memory of 120	864	1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe	93
PID 864 wrote to memory of 120	864	1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe	93
PID 864 wrote to memory of 120	864	1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe	93
PID 6000 wrote to memory of 6016	6000	powershell.exe	96
PID 5032 wrote to memory of 1792	5032	Process not Found	97
PID 6016 wrote to memory of 2964	6016	fZGjWDcWCl.exe	99
PID 6016 wrote to memory of 780	6016	fZGjWDcWCl.exe	101
PID 6016 wrote to memory of 780	6016	fZGjWDcWCl.exe	101
PID 6016 wrote to memory of 780	6016	fZGjWDcWCl.exe	101
PID 1792 wrote to memory of 2488	1792	wusa.exe	104

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	wusa.exe

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3692
- C:\Users\Admin\AppData\Local\Temp\1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe
  "C:\Users\Admin\AppData\Local\Temp\1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4360
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:5640
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:5628
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:120

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\5w3nncq21yy.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6000
- C:\Users\Admin\AppData\Roaming\fZGjWDcWCl.exe
  "C:\Users\Admin\AppData\Roaming\fZGjWDcWCl.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:6016
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fZGjWDcWCl.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2964
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:780

C:\Windows\SysWOW64\wusa.exe
"C:\Windows\SysWOW64\wusa.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- outlook_office_path
PID:1792
- C:\Program Files\Mozilla Firefox\Firefox.exe
  "C:\Program Files\Mozilla Firefox\Firefox.exe"
  2⤵
  PID:2488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 7ebace1830bacafd8518cf313f1a9d785986a0998b8b49e448b479e96ca09460
MD5 154a62f51d85da1370e8997e00f8ec96
SHA1 08f4dc5ac57099b944e1de73c85e971057594681
SHA512 c88c5dfc43d7a845e0f791357ddc48cc384f25174aab86176e654577491e2807982911f0a7e0b73c4ed14096b9db81a922bd403d111340a4914265ec49c75898
SSDEEP 384:/1eBaoT1iBGSGW14b2yghVE0+N+Lkjrr2PnZIAXr4B+BWIyzKwYvYbhNaPMlRtX+:dexZ6GJWiCzDEJ+U6RIAXrq+a3bhNaPl
TLSH
T1A9A2B478213F6DC7D8D226B410D20AE7FBE4D489DAB611D4BF1BDE2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5w3nncq21yy.ps1

Path C:\Users\Admin\AppData\Local\Temp\5w3nncq21yy.ps1
Size 1KB
SHA256 6d6fdd13ce0eaed1230b6ebd5bad6bfbceb0dec41b4632a87aec539dc630761a
MD5 7a3a4aaad173fb2d100a353a900e362c
SHA1 3215ad852f4bfc33f16081c66d4b28fb0510e9e5
SHA512 050e7029bb3922d2fabca647a4c0f75f9e77dd488e6a0868c646771a9ef946cc48ef10c8bbdcdd2b9711b589cbdeb08a4dc51e290344310c40ae871861a14429
TLSH
T16711014B8E8807C6546807F1091375CDB56D60CB27AF029058ECB0EDB32BD23346ACE4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_vbeamqtz.35o.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vbeamqtz.35o.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

fZGjWDcWCl.exe

Path C:\Users\Admin\AppData\Roaming\fZGjWDcWCl.exe
Size 1003KB
SHA256 1ee405874dd8f5229bc3620da16e5cef0572a477e0f0893b38123dc290451029
MD5 3ec946c87a5bd89ad8b744a2dc9771a3
SHA1 235f368abd1a8396a14ddd6bb7e491fcc91211b6
SHA512 9ba0b7b4476e3f6978313c0c25003ac77f95afbce406319bf2126aa5c6d1d54d8e5c6406f7ef0d7b304e375e99afb55c3160bfadb53125d2bb9ca1ba4d0e5bcc
SSDEEP 24576:wJhdQAIYd24wqb4rve+Txeua059NFZ/dQ1lfL:wJhdFlLwqbGe+TIun9h0
TLSH
T156251298DE09CA12D9925BF46861F33E52715CCEDA04C3A7C9FD9EDF3C19B096C24982
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/120-16-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/120-28-0x0000000000AC0000-0x0000000000B06000-memory.dmp

Download

memory/120-54-0x0000000000AC0000-0x0000000000B06000-memory.dmp

Download

memory/120-24-0x00000000010F0000-0x0000000001464000-memory.dmp

Download

memory/120-17-0x0000000000AC0000-0x0000000000B06000-memory.dmp

Download

memory/864-7-0x0000000074212000-0x0000000074213000-memory.dmp

Download

memory/864-8-0x0000000074200000-0x00000000749BC000-memory.dmp

Download

memory/864-5-0x0000000074200000-0x00000000749BC000-memory.dmp

Download

memory/864-1-0x0000000000590000-0x0000000000690000-memory.dmp

Download

memory/864-0-0x0000000074212000-0x0000000074213000-memory.dmp

Download

memory/864-10-0x00000000078C0000-0x000000000795C000-memory.dmp

Download

memory/864-9-0x0000000007700000-0x00000000077E2000-memory.dmp

Download

memory/864-25-0x0000000074200000-0x00000000749BC000-memory.dmp

Download

memory/864-2-0x0000000005840000-0x0000000005DFA000-memory.dmp

Download

memory/864-3-0x00000000051A0000-0x0000000005232000-memory.dmp

Download

memory/864-4-0x0000000005190000-0x000000000519A000-memory.dmp

Download

memory/864-6-0x0000000005450000-0x0000000005466000-memory.dmp

Download

memory/1792-55-0x0000000000490000-0x00000000004D3000-memory.dmp

Download

memory/1792-52-0x0000000000490000-0x00000000004D3000-memory.dmp

Download

memory/2488-74-0x0000028FECC70000-0x0000028FECD90000-memory.dmp

Download

memory/2964-63-0x0000000070390000-0x00000000703DC000-memory.dmp

Download

memory/2964-60-0x0000000005EB0000-0x000000000620B000-memory.dmp

Download

memory/2964-62-0x0000000006750000-0x000000000679C000-memory.dmp

Download

memory/2964-66-0x0000000007420000-0x00000000074C3000-memory.dmp

Download

memory/3692-56-0x0000000006610000-0x0000000006719000-memory.dmp

Download

memory/4360-13-0x0000000074200000-0x00000000749BC000-memory.dmp

Download

memory/4360-50-0x0000000074200000-0x00000000749BC000-memory.dmp

Download

memory/4360-37-0x0000000006970000-0x0000000006990000-memory.dmp

Download

memory/4360-33-0x0000000007340000-0x0000000007376000-memory.dmp

Download

memory/4360-11-0x0000000002B50000-0x0000000002B86000-memory.dmp

Download

memory/4360-14-0x0000000005820000-0x0000000005E6A000-memory.dmp

Download

memory/4360-42-0x00000000075B0000-0x0000000007653000-memory.dmp

Download

memory/4360-43-0x0000000007D30000-0x00000000083AC000-memory.dmp

Download

memory/4360-44-0x00000000076F0000-0x000000000770A000-memory.dmp

Download

memory/4360-45-0x0000000007760000-0x000000000776A000-memory.dmp

Download

memory/4360-46-0x0000000007960000-0x00000000079F6000-memory.dmp

Download

memory/4360-15-0x0000000074200000-0x00000000749BC000-memory.dmp

Download

memory/4360-20-0x00000000057A0000-0x0000000005806000-memory.dmp

Download

memory/4360-34-0x0000000074AE0000-0x0000000074B2C000-memory.dmp

Download

memory/4360-51-0x0000000074200000-0x00000000749BC000-memory.dmp

Download

memory/4360-27-0x00000000068E0000-0x000000000692C000-memory.dmp

Download

memory/4360-19-0x0000000005730000-0x0000000005796000-memory.dmp

Download

memory/4360-26-0x0000000006270000-0x000000000628E000-memory.dmp

Download

memory/4360-23-0x0000000005E70000-0x00000000061CB000-memory.dmp

Download

memory/4360-18-0x0000000005690000-0x00000000056B2000-memory.dmp

Download

memory/5032-53-0x0000000000D10000-0x000000000206B000-memory.dmp

Download

memory/5032-41-0x0000000000D10000-0x000000000206B000-memory.dmp

Download

memory/6000-31-0x000001F4F9980000-0x000001F4F99A2000-memory.dmp

Download

memory/6000-40-0x000001F4F9DA0000-0x000001F4F9E1C000-memory.dmp

Download

memory/6016-47-0x0000000004F10000-0x0000000004F26000-memory.dmp

Download