formbook | e0907a6a8bc42246d371ed78a42235838b1135fd6a32e5fd5caa7fcf48eb7696

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Potvrdenie novej objednávky.PDF.exe
Size 1.0MB
Sample260925-ka8syswyez
SHA256 e0907a6a8bc42246d371ed78a42235838b1135fd6a32e5fd5caa7fcf48eb7696
MD5 7f94553b9292110f53528d82b725d246
SHA1 6b97c59c7c640be1e628bbecae6951f6e73028e0
SHA512 2e793c27f9399edb36b381d08f99d7d32324399d67d8d71758e4a7a9dcfd86967ee326e0982f18e82802f1684120f716871ab89ebc419ba14e9591861585d282
SSDEEP 24576:lCMAhwPebgiCEYh+ZT11Q4cvUFoA55/3NUvu3oA+s0Cazoum:JXPebfCEYYZp1Q4xoCrx3v0CAe
TLSH
T1BF3512656B29D647DCE40BB80AB2F3B507B40D8AA925D386CEFDBCE77411B161D48383
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware collection defense_evasion discovery execution formbook persistence privilege_escalation rat spyware stealer trojan

Malware Config

Signatures

Family: Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2864-13-0x0000000000BE0000-0x0000000000C26000-memory.dmp	family_formbook
behavioral1/memory/2864-41-0x0000000000BE0000-0x0000000000C26000-memory.dmp	family_formbook
behavioral1/memory/2864-71-0x0000000000BE0000-0x0000000000C26000-memory.dmp	family_formbook
behavioral1/memory/3440-72-0x0000000000B80000-0x0000000000BC3000-memory.dmp	family_formbook

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4376	powershell.exe
4140	powershell.exe
2960	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	Potvrdenie novej objednávky.PDF.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	cZa.exe

Executes dropped EXE 1 IoCs

pid	Process
4152	cZa.exe

Accesses Microsoft Outlook profiles 1 TTPs 1 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	cmmon32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\cZa = "\"C:\\Windows\\system32\\WindowsPowerShell\\v1.0\\powershell.exe\" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command \"$n4vbgx=[System.Environment]::TickCount;$1uynlu=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$n4vbgx=[System.Environment]::TickCount;$0syqhp=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXGNaYS5leGU=')));$vdsyp5=$env:COMPUTERNAME;& $1uynlu -FilePath $0syqhp\""	Potvrdenie novej objednávky.PDF.exe

SmartAssembly .NET packer 1 IoCs

Detects SmartAssembly .NET packer.

resource	yara_rule
behavioral1/memory/4652-6-0x0000000005D90000-0x0000000005DAA000-memory.dmp	SmartAssembly

Suspicious use of SetThreadContext 7 IoCs

description	pid	Process	procid_target
PID 4652 set thread context of 2864	4652	Potvrdenie novej objednávky.PDF.exe	102
PID 2864 set thread context of 968	2864	RegSvcs.exe
PID 2864 set thread context of 3440	2864	RegSvcs.exe	106
PID 3440 set thread context of 3288	3440	cmmon32.exe	56
PID 4152 set thread context of 4848	4152	cZa.exe	117
PID 3440 set thread context of 1496	3440	cmmon32.exe	118
PID 3440 set thread context of 4236	3440	cmmon32.exe	121

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmmon32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Potvrdenie novej objednávky.PDF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cZa.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\User\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2	cmmon32.exe

Suspicious behavior: EnumeratesProcesses 46 IoCs

pid	Process
4652	Potvrdenie novej objednávky.PDF.exe
4652	Potvrdenie novej objednávky.PDF.exe
2864	RegSvcs.exe
2864	RegSvcs.exe
2960	powershell.exe
2864	RegSvcs.exe
2960	powershell.exe
2864	RegSvcs.exe
4376	powershell.exe
4376	powershell.exe
4376	powershell.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
4152	cZa.exe
4152	cZa.exe
4152	cZa.exe
4152	cZa.exe
4152	cZa.exe
4152	cZa.exe
4152	cZa.exe
4152	cZa.exe
4152	cZa.exe
4152	cZa.exe
4152	cZa.exe
4848	RegSvcs.exe
4140	powershell.exe
4140	powershell.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe

Suspicious behavior: MapViewOfSection 1 TTPs 7 IoCs

defense_evasion privilege_escalation

Process Injection

T1055

pid	Process
2864	RegSvcs.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe
3440	cmmon32.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

description	pid	Process
Token: SeDebugPrivilege	4652	Potvrdenie novej objednávky.PDF.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	4376	powershell.exe
Token: SeDebugPrivilege	4152	cZa.exe
Token: SeShutdownPrivilege	3288	Explorer.EXE
Token: SeCreatePagefilePrivilege	3288	Explorer.EXE
Token: SeShutdownPrivilege	3288	Explorer.EXE
Token: SeCreatePagefilePrivilege	3288	Explorer.EXE
Token: SeDebugPrivilege	4140	powershell.exe
Token: SeShutdownPrivilege	3288	Explorer.EXE
Token: SeCreatePagefilePrivilege	3288	Explorer.EXE
Token: SeShutdownPrivilege	3288	Explorer.EXE
Token: SeCreatePagefilePrivilege	3288	Explorer.EXE
Token: SeShutdownPrivilege	3288	Explorer.EXE
Token: SeCreatePagefilePrivilege	3288	Explorer.EXE
Token: SeShutdownPrivilege	3288	Explorer.EXE
Token: SeCreatePagefilePrivilege	3288	Explorer.EXE

Suspicious use of UnmapMainImage 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Hollowing

T1055.012

pid	Process
3288	Explorer.EXE

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 2960	4652	Potvrdenie novej objednávky.PDF.exe	100
PID 4652 wrote to memory of 2864	4652	Potvrdenie novej objednávky.PDF.exe	102
PID 4652 wrote to memory of 2864	4652	Potvrdenie novej objednávky.PDF.exe	102
PID 4652 wrote to memory of 2864	4652	Potvrdenie novej objednávky.PDF.exe	102
PID 4376 wrote to memory of 4152	4376	powershell.exe	105
PID 4152 wrote to memory of 4140	4152	cZa.exe	111
PID 4152 wrote to memory of 3904	4152	cZa.exe	113
PID 4152 wrote to memory of 4036	4152	cZa.exe	114
PID 4152 wrote to memory of 2548	4152	cZa.exe	115
PID 4152 wrote to memory of 3672	4152	cZa.exe	116
PID 4152 wrote to memory of 4848	4152	cZa.exe	117
PID 4152 wrote to memory of 4848	4152	cZa.exe	117
PID 4152 wrote to memory of 4848	4152	cZa.exe	117
PID 3440 wrote to memory of 1496	3440	cmmon32.exe	118
PID 3440 wrote to memory of 4236	3440	cmmon32.exe	121

outlook_office_path 1 IoCs

description	ioc	Process
Key enumerated	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook	cmmon32.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
PID:3288
- C:\Users\Admin\AppData\Local\Temp\Potvrdenie novej objednávky.PDF.exe
  "C:\Users\Admin\AppData\Local\Temp\Potvrdenie novej objednávky.PDF.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Potvrdenie novej objednávky.PDF.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2864

C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$n4vbgx=[System.Environment]::TickCount;$1uynlu=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('U3RhcnQtUHJvY2Vzcw==')));$n4vbgx=[System.Environment]::TickCount;$0syqhp=([System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('QzpcVXNlcnNcQWRtaW5cQXBwRGF0YVxSb2FtaW5nXGNaYS5leGU=')));$vdsyp5=$env:COMPUTERNAME;& $1uynlu -FilePath $0syqhp"
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4376
- C:\Users\Admin\AppData\Roaming\cZa.exe
  "C:\Users\Admin\AppData\Roaming\cZa.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\cZa.exe"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4140
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:3904
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:4036
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:2548
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    PID:3672
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4848

C:\Windows\SysWOW64\cmmon32.exe
"C:\Windows\SysWOW64\cmmon32.exe"
1⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
- outlook_office_path
PID:3440
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  PID:1496
- C:\Program Files\Mozilla Firefox\Firefox.exe
  "C:\Program Files\Mozilla Firefox\Firefox.exe"
  2⤵
  PID:4236

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2776

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Process Injection

T1055

Process Hollowing

T1055.012

Defense Evasion

Modify Registry

T1112

Process Injection

T1055

Process Hollowing

T1055.012

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
TLSH
T1A4417C303261A9D84D435B0215286ED5E3EF478AAFAC5F5CB569231DCE2A44BD7221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 6178559bd6db49e30cd0c3ee86bb8b8f56934a0b34713f07a7da51e0dfc65da2
MD5 fd1e54364ce058fd17eb6b48544ef73d
SHA1 f9da3699efb5101829db650481173a4137855a0c
SHA512 e8d7cb54e775e507ec742c240d942aaea5ae8c75c1eeb78ee060a1345572a2cba10673e958e0c52775cd52db6c2c3276995c317389378d3ad02239f36b0d4176
SSDEEP 384:rsf+B29i+2Fb75ok+o9oGT/yK6seYLME/B03SoZKfYSgojEDkSQ0gdMtkKhD:wfcFjoGT/yNgrqSVW2ED/Cm3
TLSH
T14B82D66E611F16C3C49613B8E11B045FE8F2DD8D531A13D87B1E9F3B4AACA9E903D548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_k2tkarab.qfj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k2tkarab.qfj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

cZa.exe

Path C:\Users\Admin\AppData\Roaming\cZa.exe
Size 1.0MB
SHA256 e0907a6a8bc42246d371ed78a42235838b1135fd6a32e5fd5caa7fcf48eb7696
MD5 7f94553b9292110f53528d82b725d246
SHA1 6b97c59c7c640be1e628bbecae6951f6e73028e0
SHA512 2e793c27f9399edb36b381d08f99d7d32324399d67d8d71758e4a7a9dcfd86967ee326e0982f18e82802f1684120f716871ab89ebc419ba14e9591861585d282
SSDEEP 24576:lCMAhwPebgiCEYh+ZT11Q4cvUFoA55/3NUvu3oA+s0Cazoum:JXPebfCEYYZp1Q4xoCrx3v0CAe
TLSH
T1BF3512656B29D647DCE40BB80AB2F3B507B40D8AA925D386CEFDBCE77411B161D48383
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1496-102-0x0000022958390000-0x0000022958491000-memory.dmp

Download

memory/2864-17-0x0000000001300000-0x000000000164A000-memory.dmp

Download

memory/2864-71-0x0000000000BE0000-0x0000000000C26000-memory.dmp

Download

memory/2864-69-0x0000000000BE0000-0x0000000000C26000-memory.dmp

Download

memory/2864-41-0x0000000000BE0000-0x0000000000C26000-memory.dmp

Download

memory/2864-12-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/2864-13-0x0000000000BE0000-0x0000000000C26000-memory.dmp

Download

memory/2960-16-0x0000000002570000-0x00000000025A6000-memory.dmp

Download

memory/2960-59-0x0000000007260000-0x000000000726A000-memory.dmp

Download

memory/2960-18-0x0000000004A60000-0x0000000004A70000-memory.dmp

Download

memory/2960-15-0x0000000004A60000-0x0000000004A70000-memory.dmp

Download

memory/2960-19-0x00000000050A0000-0x00000000056C8000-memory.dmp

Download

memory/2960-21-0x0000000004F30000-0x0000000004F96000-memory.dmp

Download

memory/2960-22-0x0000000004FA0000-0x0000000005006000-memory.dmp

Download

memory/2960-20-0x0000000004E90000-0x0000000004EB2000-memory.dmp

Download

memory/2960-65-0x0000000007530000-0x0000000007538000-memory.dmp

Download

memory/2960-28-0x0000000005810000-0x0000000005B64000-memory.dmp

Download

memory/2960-31-0x0000000005ED0000-0x0000000005EEE000-memory.dmp

Download

memory/2960-32-0x0000000005F60000-0x0000000005FAC000-memory.dmp

Download

memory/2960-64-0x0000000007550000-0x000000000756A000-memory.dmp

Download

memory/2960-63-0x0000000007450000-0x0000000007464000-memory.dmp

Download

memory/2960-62-0x0000000007440000-0x000000000744E000-memory.dmp

Download

memory/2960-47-0x0000000071210000-0x000000007125C000-memory.dmp

Download

memory/2960-55-0x0000000006480000-0x000000000649E000-memory.dmp

Download

memory/2960-46-0x00000000064A0000-0x00000000064D2000-memory.dmp

Download

memory/2960-56-0x00000000064F0000-0x0000000006593000-memory.dmp

Download

memory/2960-58-0x00000000071F0000-0x000000000720A000-memory.dmp

Download

memory/2960-57-0x0000000007830000-0x0000000007EAA000-memory.dmp

Download

memory/2960-61-0x0000000007410000-0x0000000007421000-memory.dmp

Download

memory/2960-60-0x0000000007490000-0x0000000007526000-memory.dmp

Download

memory/3288-73-0x0000000008FD0000-0x0000000009095000-memory.dmp

Download

memory/3440-70-0x0000000000B80000-0x0000000000BC3000-memory.dmp

Download

memory/3440-72-0x0000000000B80000-0x0000000000BC3000-memory.dmp

Download

memory/4140-96-0x0000000007230000-0x00000000072D3000-memory.dmp

Download

memory/4140-97-0x0000000007510000-0x0000000007521000-memory.dmp

Download

memory/4140-100-0x0000000007540000-0x0000000007554000-memory.dmp

Download

memory/4140-88-0x0000000070350000-0x000000007039C000-memory.dmp

Download

memory/4140-86-0x0000000006540000-0x000000000658C000-memory.dmp

Download

memory/4140-84-0x0000000005A90000-0x0000000005DE4000-memory.dmp

Download

memory/4236-106-0x0000021E52380000-0x0000021E52494000-memory.dmp

Download

memory/4376-39-0x0000018B55110000-0x0000018B55132000-memory.dmp

Download

memory/4652-7-0x0000000005B20000-0x0000000005B30000-memory.dmp

Download

memory/4652-6-0x0000000005D90000-0x0000000005DAA000-memory.dmp

Download

memory/4652-2-0x0000000005900000-0x0000000005992000-memory.dmp

Download

memory/4652-3-0x0000000005B20000-0x0000000005B30000-memory.dmp

Download

memory/4652-4-0x0000000005A90000-0x0000000005A9A000-memory.dmp

Download

memory/4652-0-0x0000000000E00000-0x0000000000F10000-memory.dmp

Download

memory/4652-8-0x0000000007100000-0x00000000071E8000-memory.dmp

Download

memory/4652-5-0x0000000005BD0000-0x0000000005C6C000-memory.dmp

Download

memory/4652-1-0x0000000005EB0000-0x0000000006454000-memory.dmp

Download