formbook | c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9.exe
Size 1.0MB
Sample260810-rtfpvabk7z
SHA256 c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9
MD5 b3fdf47f7747a1aa8f6a1698cb899cc2
SHA1 bec514381f775b00f1012d496ab0cd9abde9ec37
SHA512 921b26671e11b649dcea15c3fbcdc1be0a97b1a687d9fb8d6a8ceed89dd024618d0105dbff27d072a763f1755873aae8339bb6d7aa2bd03847db006a2f191025
SSDEEP 24576:wW+G19tHIdV8b8XgC0m8ftzdYl/kF0RXND6bH:vxhIdV8b8Xn0m8ftal8F0RX8b
TLSH
T11A3523A08399C522C4A9577644A6D3B12376DF9EF332E76E8FCCFCABB6217102405785
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection discovery execution formbook persistence rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/2824-18-0x00000000012A0000-0x00000000012E7000-memory.dmp	family_formbook
behavioral2/memory/2824-34-0x00000000012A0000-0x00000000012E7000-memory.dmp	family_formbook
behavioral2/memory/2824-52-0x00000000012A0000-0x00000000012E7000-memory.dmp	family_formbook
behavioral2/memory/3068-53-0x0000000000660000-0x00000000006A4000-memory.dmp	family_formbook

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4740	powershell.exe
4836	powershell.exe
1088	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
1800	ATvzKXOf.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ctfmon.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Windows\CurrentVersion\Run\ATvzKXOf = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\bto1gezlwpk.ps1\""	c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral2/memory/3252-7-0x0000000005A40000-0x0000000005A50000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 3252 set thread context of 2824	3252	c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9.exe	91
PID 2824 set thread context of 2004	2824	MSBuild.exe
PID 2824 set thread context of 3068	2824	MSBuild.exe	95
PID 3068 set thread context of 3116	3068	ctfmon.exe	81
PID 3068 set thread context of 3444	3068	ctfmon.exe	97
PID 1800 set thread context of 1392	1800	ATvzKXOf.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ATvzKXOf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ctfmon.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-1875162379-3804078649-638427191-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	ctfmon.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3252	c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9.exe
3252	c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9.exe
4740	powershell.exe
2824	MSBuild.exe
2824	MSBuild.exe
4740	powershell.exe
2824	MSBuild.exe
2824	MSBuild.exe
1088	powershell.exe
1088	powershell.exe
1088	powershell.exe
3068	ctfmon.exe
3068	ctfmon.exe
3068	ctfmon.exe
3068	ctfmon.exe
3068	ctfmon.exe
3068	ctfmon.exe
3068	ctfmon.exe
3068	ctfmon.exe
3068	ctfmon.exe
1800	ATvzKXOf.exe
1800	ATvzKXOf.exe
1392	MSBuild.exe
4836	powershell.exe
4836	powershell.exe
3068	ctfmon.exe
3068	ctfmon.exe
3068	ctfmon.exe
3068	ctfmon.exe
3068	ctfmon.exe
3068	ctfmon.exe
3068	ctfmon.exe
3068	ctfmon.exe
3068	ctfmon.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3116	explorer.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2824	MSBuild.exe
3068	ctfmon.exe
3068	ctfmon.exe
3068	ctfmon.exe
3068	ctfmon.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3252	c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9.exe
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	1088	powershell.exe
Token: SeIncreaseQuotaPrivilege	4740	powershell.exe
Token: SeSecurityPrivilege	4740	powershell.exe
Token: SeTakeOwnershipPrivilege	4740	powershell.exe
Token: SeLoadDriverPrivilege	4740	powershell.exe
Token: SeSystemProfilePrivilege	4740	powershell.exe
Token: SeSystemtimePrivilege	4740	powershell.exe
Token: SeProfSingleProcessPrivilege	4740	powershell.exe
Token: SeIncBasePriorityPrivilege	4740	powershell.exe
Token: SeCreatePagefilePrivilege	4740	powershell.exe
Token: SeBackupPrivilege	4740	powershell.exe
Token: SeRestorePrivilege	4740	powershell.exe
Token: SeShutdownPrivilege	4740	powershell.exe
Token: SeDebugPrivilege	4740	powershell.exe
Token: SeSystemEnvironmentPrivilege	4740	powershell.exe
Token: SeRemoteShutdownPrivilege	4740	powershell.exe
Token: SeUndockPrivilege	4740	powershell.exe
Token: SeManageVolumePrivilege	4740	powershell.exe
Token: 33	4740	powershell.exe
Token: 34	4740	powershell.exe
Token: 35	4740	powershell.exe
Token: 36	4740	powershell.exe
Token: SeShutdownPrivilege	3116	explorer.exe
Token: SeCreatePagefilePrivilege	3116	explorer.exe
Token: SeShutdownPrivilege	3116	explorer.exe
Token: SeCreatePagefilePrivilege	3116	explorer.exe
Token: SeShutdownPrivilege	3116	explorer.exe
Token: SeCreatePagefilePrivilege	3116	explorer.exe
Token: SeShutdownPrivilege	3116	explorer.exe
Token: SeCreatePagefilePrivilege	3116	explorer.exe
Token: SeDebugPrivilege	1800	ATvzKXOf.exe
Token: SeShutdownPrivilege	3116	explorer.exe
Token: SeCreatePagefilePrivilege	3116	explorer.exe
Token: SeShutdownPrivilege	3116	explorer.exe
Token: SeCreatePagefilePrivilege	3116	explorer.exe
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeIncreaseQuotaPrivilege	4836	powershell.exe
Token: SeSecurityPrivilege	4836	powershell.exe
Token: SeTakeOwnershipPrivilege	4836	powershell.exe
Token: SeLoadDriverPrivilege	4836	powershell.exe
Token: SeSystemProfilePrivilege	4836	powershell.exe
Token: SeSystemtimePrivilege	4836	powershell.exe
Token: SeProfSingleProcessPrivilege	4836	powershell.exe
Token: SeIncBasePriorityPrivilege	4836	powershell.exe
Token: SeCreatePagefilePrivilege	4836	powershell.exe
Token: SeBackupPrivilege	4836	powershell.exe
Token: SeRestorePrivilege	4836	powershell.exe
Token: SeShutdownPrivilege	4836	powershell.exe
Token: SeDebugPrivilege	4836	powershell.exe
Token: SeSystemEnvironmentPrivilege	4836	powershell.exe
Token: SeRemoteShutdownPrivilege	4836	powershell.exe
Token: SeUndockPrivilege	4836	powershell.exe
Token: SeManageVolumePrivilege	4836	powershell.exe
Token: 33	4836	powershell.exe
Token: 34	4836	powershell.exe
Token: 35	4836	powershell.exe
Token: 36	4836	powershell.exe
Token: SeShutdownPrivilege	3116	explorer.exe
Token: SeCreatePagefilePrivilege	3116	explorer.exe
Token: SeShutdownPrivilege	3116	explorer.exe
Token: SeCreatePagefilePrivilege	3116	explorer.exe
Token: SeShutdownPrivilege	3116	explorer.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3252 wrote to memory of 4740	3252	c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9.exe	89
PID 3252 wrote to memory of 2824	3252	c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9.exe	91
PID 3252 wrote to memory of 2824	3252	c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9.exe	91
PID 3252 wrote to memory of 2824	3252	c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9.exe	91
PID 1088 wrote to memory of 1800	1088	powershell.exe	94
PID 3068 wrote to memory of 3444	3068	ctfmon.exe	97
PID 1800 wrote to memory of 4836	1800	ATvzKXOf.exe	98
PID 1800 wrote to memory of 1392	1800	ATvzKXOf.exe	100
PID 1800 wrote to memory of 1392	1800	ATvzKXOf.exe	100
PID 1800 wrote to memory of 1392	1800	ATvzKXOf.exe	100

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook	ctfmon.exe

C:\Windows\explorer.exe
explorer.exe /LOADSAVEDWINDOWS
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3116
- C:\Users\Admin\AppData\Local\Temp\c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9.exe
  "C:\Users\Admin\AppData\Local\Temp\c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3252
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4740
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2824

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -File "C:\Users\Admin\AppData\Local\Temp\bto1gezlwpk.ps1"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Users\Admin\AppData\Roaming\ATvzKXOf.exe
  "C:\Users\Admin\AppData\Roaming\ATvzKXOf.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1800
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ATvzKXOf.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4836
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1392

C:\Windows\SysWOW64\ctfmon.exe
"C:\Windows\SysWOW64\ctfmon.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- outlook_office_path
PID:3068
- C:\Program Files\Mozilla Firefox\Firefox.exe
  "C:\Program Files\Mozilla Firefox\Firefox.exe"
  2⤵
  PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 21KB
SHA256 1e55186dd8c475a3c15627fadd89e9f174a08c98df3632a157b7fd7624fe9fa9
MD5 c524b11f40502f961c7a2ac17add763d
SHA1 cc9356eb3792fc116c2fa540749057585aa43e4d
SHA512 88f8e8120431adfec03265852d548ffbf1ac4188234e030db461236b5e026bb2e7d679b9fcf988aaeb5ff98c9f17833af14a91e9402a19945ab5ba213f1e908b
SSDEEP 384:v1eBaoT1iBGCGW14bQxkt0a/+geZ1or2Pn5IAXr4B+dWoVIzKwMvYbhNaPElRtry:texZ6GZWi+oz/+O6RIAXrq+tojbhNaP1
TLSH
T159A2C478213F6DC7D8D222B410D10AB7FBE4D489DAB611D4AF2BDA2F4C90EB64A60524
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_oz5oq4jd.2zp.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_oz5oq4jd.2zp.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bto1gezlwpk.ps1

Path C:\Users\Admin\AppData\Local\Temp\bto1gezlwpk.ps1
Size 1KB
SHA256 8bef54163d584c9286ae5651c47e5aa64b6124abb7e643fb909ca2113ec531f4
MD5 c3832750c063901ab8839a4186ce5c7b
SHA1 4eb759262ec853ae19bff7df1f62d63610d00e25
SHA512 5ca93e70c5fec78a10da1f6499f1dd7cba36262296d841ed7619e32044a3a32a696b2b3d4efd6bd62dc00012cc3339ee4e0fc44a004e458bca5adf5f68514cfa
TLSH
T18111A01B8E8447C6806407F45503B0DCB26E62DB2BBF459044EDB5EDB32BE62343ADE9
MD5 SHA1 SHA512 TLSH

Submit Download

ATvzKXOf.exe

Path C:\Users\Admin\AppData\Roaming\ATvzKXOf.exe
Size 1.0MB
SHA256 c7d33bbd5b5e9b32907ec498e8db40e0bf3af7a07e2fdf798928eb0ff50611e9
MD5 b3fdf47f7747a1aa8f6a1698cb899cc2
SHA1 bec514381f775b00f1012d496ab0cd9abde9ec37
SHA512 921b26671e11b649dcea15c3fbcdc1be0a97b1a687d9fb8d6a8ceed89dd024618d0105dbff27d072a763f1755873aae8339bb6d7aa2bd03847db006a2f191025
SSDEEP 24576:wW+G19tHIdV8b8XgC0m8ftzdYl/kF0RXND6bH:vxhIdV8b8Xn0m8ftal8F0RX8b
TLSH
T11A3523A08399C522C4A9577644A6D3B12376DF9EF332E76E8FCCFCABB6217102405785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1088-30-0x0000022231930000-0x0000022231952000-memory.dmp

Download

memory/2824-23-0x0000000001680000-0x00000000019F4000-memory.dmp

Download

memory/2824-34-0x00000000012A0000-0x00000000012E7000-memory.dmp

Download

memory/2824-19-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2824-18-0x00000000012A0000-0x00000000012E7000-memory.dmp

Download

memory/2824-51-0x00000000012A0000-0x00000000012E7000-memory.dmp

Download

memory/2824-52-0x00000000012A0000-0x00000000012E7000-memory.dmp

Download

memory/3068-50-0x0000000000660000-0x00000000006A4000-memory.dmp

Download

memory/3068-53-0x0000000000660000-0x00000000006A4000-memory.dmp

Download

memory/3116-54-0x00000000032E0000-0x00000000033EE000-memory.dmp

Download

memory/3252-2-0x0000000005DE0000-0x000000000639A000-memory.dmp

Download

memory/3252-27-0x0000000074370000-0x0000000074B2C000-memory.dmp

Download

memory/3252-10-0x0000000006DA0000-0x0000000006E82000-memory.dmp

Download

memory/3252-9-0x0000000074370000-0x0000000074B2C000-memory.dmp

Download

memory/3252-8-0x0000000074382000-0x0000000074383000-memory.dmp

Download

memory/3252-7-0x0000000005A40000-0x0000000005A50000-memory.dmp

Download

memory/3252-6-0x0000000005A90000-0x0000000005B2C000-memory.dmp

Download

memory/3252-5-0x0000000005870000-0x000000000587A000-memory.dmp

Download

memory/3252-4-0x0000000074370000-0x0000000074B2C000-memory.dmp

Download

memory/3252-3-0x00000000058C0000-0x0000000005952000-memory.dmp

Download

memory/3252-1-0x0000000000C50000-0x0000000000D5A000-memory.dmp

Download

memory/3252-0-0x0000000074382000-0x0000000074383000-memory.dmp

Download

memory/3444-61-0x0000022ACB740000-0x0000022ACB83C000-memory.dmp

Download

memory/4740-20-0x0000000005840000-0x0000000005862000-memory.dmp

Download

memory/4740-28-0x0000000006600000-0x000000000661E000-memory.dmp

Download

memory/4740-29-0x00000000066D0000-0x000000000671C000-memory.dmp

Download

memory/4740-37-0x00000000077E0000-0x0000000007816000-memory.dmp

Download

memory/4740-38-0x0000000074C30000-0x0000000074C7C000-memory.dmp

Download

memory/4740-24-0x0000000006130000-0x000000000648B000-memory.dmp

Download

memory/4740-41-0x0000000006BF0000-0x0000000006C10000-memory.dmp

Download

memory/4740-42-0x0000000007830000-0x00000000078D3000-memory.dmp

Download

memory/4740-43-0x0000000007FD0000-0x000000000864C000-memory.dmp

Download

memory/4740-44-0x0000000007990000-0x00000000079AA000-memory.dmp

Download

memory/4740-45-0x0000000007A00000-0x0000000007A0A000-memory.dmp

Download

memory/4740-46-0x0000000007C00000-0x0000000007C96000-memory.dmp

Download

memory/4740-21-0x0000000006030000-0x0000000006096000-memory.dmp

Download

memory/4740-49-0x0000000074370000-0x0000000074B2C000-memory.dmp

Download

memory/4740-22-0x00000000060A0000-0x0000000006106000-memory.dmp

Download

memory/4740-17-0x0000000074370000-0x0000000074B2C000-memory.dmp

Download

memory/4740-15-0x0000000074370000-0x0000000074B2C000-memory.dmp

Download

memory/4740-13-0x0000000074370000-0x0000000074B2C000-memory.dmp

Download

memory/4740-14-0x00000000059E0000-0x000000000602A000-memory.dmp

Download

memory/4740-12-0x0000000002DF0000-0x0000000002E26000-memory.dmp

Download

memory/4836-65-0x00000000060E0000-0x000000000643B000-memory.dmp

Download

memory/4836-67-0x0000000006A50000-0x0000000006A9C000-memory.dmp

Download

memory/4836-68-0x0000000070910000-0x000000007095C000-memory.dmp

Download

memory/4836-71-0x0000000007750000-0x00000000077F3000-memory.dmp

Download