fabookie | 48b0afb9f404d55c311994ab4da41e3aa6dacd23a1b8e0de1addfe6f9fea4d11

Analysis

max time kernel
0s
max time network
146s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 04:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f181b08d7d06f955a53a2593b3596991.exe
Size

5.0MB
MD5

f181b08d7d06f955a53a2593b3596991
SHA1

c2af74c384c68491121799a8d89b5cd4322c41b2
SHA256

48b0afb9f404d55c311994ab4da41e3aa6dacd23a1b8e0de1addfe6f9fea4d11
SHA512

5784992d21762b523176b3a35e5611916568366fc3abf06cff54c6c1a2b77792f5a50f040facc4b3c786edc31d71b1a41d26a3708483289b3867e949fd515731
SSDEEP

49152:lhUCgfFMiW4UnAnkOh9pjA7E9HgFRJ9Tp4mMeJmjMjK0JlUJkGf3yIGul:s9AdHBJmg1wJkGZl

Score

10^/10

fabookie glupteba stealc dropper evasion loader spyware stealer trojan

Malware Config

Extracted

Family

stealc

http://185.172.128.79

Attributes

url_path
/3886d2276f6914c4.php

rc4.plain

Signatures

Detect Fabookie payload 1 IoCs

resource	yara_rule
behavioral1/memory/1360-649-0x0000000003520000-0x0000000003651000-memory.dmp	family_fabookie

Fabookie
Fabookie is facebook account info stealer.
spyware stealer fabookie
Glupteba
Glupteba is a modular loader written in Golang with various components.
loader dropper glupteba

Glupteba payload 15 IoCs

resource	yara_rule
behavioral1/memory/1620-427-0x00000000029A0000-0x000000000328B000-memory.dmp	family_glupteba
behavioral1/memory/1620-435-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/1620-458-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/1620-461-0x00000000029A0000-0x000000000328B000-memory.dmp	family_glupteba
behavioral1/memory/1484-497-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2320-502-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2320-507-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2240-506-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2352-512-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2352-511-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/1484-464-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2240-564-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2240-565-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2240-604-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba
behavioral1/memory/2240-641-0x0000000000400000-0x0000000000D1C000-memory.dmp	family_glupteba

Stealc
Stealc is an infostealer written in C++.
stealer stealc

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f181b08d7d06f955a53a2593b3596991.exe

Downloads MZ/PE file

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Windows Service

T1543.003

pid	Process
812	netsh.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f181b08d7d06f955a53a2593b3596991.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1564	schtasks.exe
2612	schtasks.exe
1832	schtasks.exe
292	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2564	timeout.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1748	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2024	f181b08d7d06f955a53a2593b3596991.exe
Token: SeDebugPrivilege	1748	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2024 wrote to memory of 1748	2024	f181b08d7d06f955a53a2593b3596991.exe	14
PID 2024 wrote to memory of 1748	2024	f181b08d7d06f955a53a2593b3596991.exe	14
PID 2024 wrote to memory of 1748	2024	f181b08d7d06f955a53a2593b3596991.exe	14

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	f181b08d7d06f955a53a2593b3596991.exe

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f181b08d7d06f955a53a2593b3596991.exe" -Force
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1748

C:\Users\Admin\AppData\Local\Temp\f181b08d7d06f955a53a2593b3596991.exe
"C:\Users\Admin\AppData\Local\Temp\f181b08d7d06f955a53a2593b3596991.exe"
1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2024
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  PID:2556
- - C:\Users\Admin\Pictures\g4SadwI2XT7iyL3ArBNrdcY1.exe
    "C:\Users\Admin\Pictures\g4SadwI2XT7iyL3ArBNrdcY1.exe"
    3⤵
    PID:1360
- - C:\Users\Admin\Pictures\BZQiuwPFWfxcuSdQEtmxBCJJ.exe
    "C:\Users\Admin\Pictures\BZQiuwPFWfxcuSdQEtmxBCJJ.exe"
    3⤵
    PID:1620
  - - C:\Users\Admin\Pictures\BZQiuwPFWfxcuSdQEtmxBCJJ.exe
      "C:\Users\Admin\Pictures\BZQiuwPFWfxcuSdQEtmxBCJJ.exe"
      4⤵
      PID:1484
- - C:\Users\Admin\Pictures\97ue7gQernDRXgcoAcznl2VQ.exe
    "C:\Users\Admin\Pictures\97ue7gQernDRXgcoAcznl2VQ.exe"
    3⤵
    PID:2320
- - C:\Users\Admin\Pictures\aFxatohwjsCvUmfYEKl6zOJS.exe
    "C:\Users\Admin\Pictures\aFxatohwjsCvUmfYEKl6zOJS.exe"
    3⤵
    PID:2116
  - - C:\Users\Admin\AppData\Local\Temp\nso9530.tmp
      C:\Users\Admin\AppData\Local\Temp\nso9530.tmp
      4⤵
      PID:2980
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nso9530.tmp" & del "C:\ProgramData\*.dll"" & exit
        5⤵
        
        PID:1548
- - C:\Users\Admin\Pictures\vmAn9QxcjALGa2ydzufkv1VF.exe
    "C:\Users\Admin\Pictures\vmAn9QxcjALGa2ydzufkv1VF.exe"
    3⤵
    PID:1600
- - C:\Users\Admin\Pictures\hz4O3tbKaOJaNZ3iJYtVNTgx.exe
    "C:\Users\Admin\Pictures\hz4O3tbKaOJaNZ3iJYtVNTgx.exe"
    3⤵
    PID:1716
  - - C:\Users\Admin\AppData\Local\Temp\7zSF132.tmp\Install.exe
      .\Install.exe
      4⤵
      PID:488
    - - C:\Users\Admin\AppData\Local\Temp\7zSF2E7.tmp\Install.exe
        
        .\Install.exe /snididFpuU "385118" /S
        5⤵
        
        PID:2320
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
        6⤵
        
        PID:280
        
        C:\Windows\SysWOW64\cmd.exe
        
        /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
        7⤵
        
        PID:2348
      - C:\Windows\SysWOW64\forfiles.exe
        
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        6⤵
        
        PID:1784
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "gRhySNwLH" /SC once /ST 01:41:11 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
        6⤵
        Creates scheduled task(s)
        
        PID:2612
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /run /I /tn "gRhySNwLH"
        6⤵
        
        PID:2676
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /DELETE /F /TN "gRhySNwLH"
        6⤵
        
        PID:2880
      - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /CREATE /TN "bQqfrfOcqJXaOOvqOO" /SC once /ST 04:09:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\kgFvdrWtvTuDliNJn\QNmqfQdbJlhVwcQ\xDZmpHS.exe\" pA /Vksite_idfXv 385118 /S" /V1 /F
        6⤵
        Creates scheduled task(s)
        
        PID:1832
- - C:\Users\Admin\Pictures\WM010lF8EsE1ZH3bUJarHDv7.exe
    "C:\Users\Admin\Pictures\WM010lF8EsE1ZH3bUJarHDv7.exe" --silent --allusers=0
    3⤵
    PID:716

C:\Windows\system32\makecab.exe
"C:\Windows\system32\makecab.exe" C:\Windows\Logs\CBS\CbsPersist_20240111040658.log C:\Windows\Logs\CBS\CbsPersist_20240111040658.cab
1⤵
PID:276

C:\Windows\system32\cmd.exe
C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
1⤵
PID:780
- C:\Windows\system32\netsh.exe
  netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:812

C:\Users\Admin\Pictures\97ue7gQernDRXgcoAcznl2VQ.exe
"C:\Users\Admin\Pictures\97ue7gQernDRXgcoAcznl2VQ.exe"
1⤵
PID:2352

C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
"C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
1⤵
PID:2792

C:\Windows\system32\schtasks.exe
schtasks /delete /tn ScheduledUpdate /f
1⤵
PID:2728

C:\Windows\system32\schtasks.exe
schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
1⤵
- Creates scheduled task(s)
PID:1564

C:\Windows\rss\csrss.exe
C:\Windows\rss\csrss.exe
1⤵
PID:2240
- C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
  C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
  2⤵
  PID:948

C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exe
1⤵
PID:1448

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
1⤵
PID:556
- \??\c:\windows\SysWOW64\reg.exe
  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
  2⤵
  PID:1160
- \??\c:\windows\SysWOW64\reg.exe
  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
  2⤵
  PID:2500

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
1⤵
PID:964

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
1⤵
PID:1640

C:\Windows\system32\taskeng.exe
taskeng.exe {4CBB00A9-9620-4226-AC1B-C146289F0813} S-1-5-21-3470981204-343661084-3367201002-1000:GLTGRJAG\Admin:Interactive:[1]
1⤵
PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  PID:1808
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
  2⤵
  PID:1296
- - C:\Windows\system32\gpupdate.exe
    "C:\Windows\system32\gpupdate.exe" /force
    3⤵
    PID:2964

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2548

C:\Windows\SysWOW64\timeout.exe
timeout /t 5
1⤵
- Delays execution with timeout.exe
PID:2564

C:\Windows\system32\taskeng.exe
taskeng.exe {70E03760-0951-4F8A-9150-190C813D5C85} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:952
- C:\Users\Admin\AppData\Local\Temp\kgFvdrWtvTuDliNJn\QNmqfQdbJlhVwcQ\xDZmpHS.exe
  C:\Users\Admin\AppData\Local\Temp\kgFvdrWtvTuDliNJn\QNmqfQdbJlhVwcQ\xDZmpHS.exe pA /Vksite_idfXv 385118 /S
  2⤵
  PID:2624
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /CREATE /TN "gNnJHApIH" /SC once /ST 00:56:53 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
    3⤵
    - Creates scheduled task(s)
    PID:292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /run /I /tn "gNnJHApIH"
    3⤵
    PID:1908

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/488-774-0x0000000002370000-0x0000000002A5D000-memory.dmp

Filesize
6.9MB

Download
memory/488-730-0x0000000002370000-0x0000000002A5D000-memory.dmp

Filesize
6.9MB

Download
memory/716-797-0x0000000000B30000-0x0000000001018000-memory.dmp

Filesize
4.9MB

Download
memory/1360-648-0x00000000026F0000-0x00000000027FC000-memory.dmp

Filesize
1.0MB

Download
memory/1360-735-0x0000000003520000-0x0000000003651000-memory.dmp

Filesize
1.2MB

Download
memory/1360-117-0x000000013F670000-0x000000013F6DF000-memory.dmp

Filesize
444KB

Download
memory/1360-649-0x0000000003520000-0x0000000003651000-memory.dmp

Filesize
1.2MB

Download
memory/1448-637-0x0000000000400000-0x0000000000965000-memory.dmp

Filesize
5.4MB

Download
memory/1448-652-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1448-585-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1484-459-0x0000000000ED0000-0x00000000012C8000-memory.dmp

Filesize
4.0MB

Download
memory/1484-464-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1484-500-0x0000000000ED0000-0x00000000012C8000-memory.dmp

Filesize
4.0MB

Download
memory/1484-497-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1484-462-0x0000000000ED0000-0x00000000012C8000-memory.dmp

Filesize
4.0MB

Download
memory/1600-675-0x0000000010000000-0x000000001001B000-memory.dmp

Filesize
108KB

Download
memory/1600-680-0x0000000004490000-0x00000000050B8000-memory.dmp

Filesize
12.2MB

Download
memory/1600-685-0x0000000002850000-0x0000000002851000-memory.dmp

Filesize
4KB

Download
memory/1600-687-0x0000000002880000-0x00000000028BA000-memory.dmp

Filesize
232KB

Download
memory/1620-415-0x0000000000DF0000-0x00000000011E8000-memory.dmp

Filesize
4.0MB

Download
memory/1620-461-0x00000000029A0000-0x000000000328B000-memory.dmp

Filesize
8.9MB

Download
memory/1620-427-0x00000000029A0000-0x000000000328B000-memory.dmp

Filesize
8.9MB

Download
memory/1620-435-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1620-414-0x0000000000DF0000-0x00000000011E8000-memory.dmp

Filesize
4.0MB

Download
memory/1620-458-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/1620-460-0x0000000000DF0000-0x00000000011E8000-memory.dmp

Filesize
4.0MB

Download
memory/1748-6-0x000007FEF5290000-0x000007FEF5C2D000-memory.dmp

Filesize
9.6MB

Download
memory/1748-11-0x0000000002CB0000-0x0000000002D30000-memory.dmp

Filesize
512KB

Download
memory/1748-9-0x0000000002CB0000-0x0000000002D30000-memory.dmp

Filesize
512KB

Download
memory/1748-12-0x000007FEF5290000-0x000007FEF5C2D000-memory.dmp

Filesize
9.6MB

Download
memory/1748-7-0x0000000002CB0000-0x0000000002D30000-memory.dmp

Filesize
512KB

Download
memory/1748-10-0x0000000002CB0000-0x0000000002D30000-memory.dmp

Filesize
512KB

Download
memory/1748-8-0x000007FEF5290000-0x000007FEF5C2D000-memory.dmp

Filesize
9.6MB

Download
memory/1748-5-0x0000000002320000-0x0000000002328000-memory.dmp

Filesize
32KB

Download
memory/1748-4-0x000000001B510000-0x000000001B7F2000-memory.dmp

Filesize
2.9MB

Download
memory/1808-768-0x0000000001E90000-0x0000000001E98000-memory.dmp

Filesize
32KB

Download
memory/1808-769-0x000007FEF47A0000-0x000007FEF513D000-memory.dmp

Filesize
9.6MB

Download
memory/1808-767-0x000000001B740000-0x000000001BA22000-memory.dmp

Filesize
2.9MB

Download
memory/1808-770-0x0000000002A50000-0x0000000002AD0000-memory.dmp

Filesize
512KB

Download
memory/1808-773-0x0000000002A50000-0x0000000002AD0000-memory.dmp

Filesize
512KB

Download
memory/1808-772-0x0000000002A50000-0x0000000002AD0000-memory.dmp

Filesize
512KB

Download
memory/1808-780-0x000007FEF47A0000-0x000007FEF513D000-memory.dmp

Filesize
9.6MB

Download
memory/1808-779-0x0000000002A50000-0x0000000002AD0000-memory.dmp

Filesize
512KB

Download
memory/1808-771-0x000007FEF47A0000-0x000007FEF513D000-memory.dmp

Filesize
9.6MB

Download
memory/2240-641-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2240-604-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2240-503-0x0000000000FD0000-0x00000000013C8000-memory.dmp

Filesize
4.0MB

Download
memory/2240-552-0x0000000000FD0000-0x00000000013C8000-memory.dmp

Filesize
4.0MB

Download
memory/2240-564-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2240-565-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2240-501-0x0000000000FD0000-0x00000000013C8000-memory.dmp

Filesize
4.0MB

Download
memory/2240-694-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2240-506-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2240-736-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2320-776-0x0000000001300000-0x00000000019ED000-memory.dmp

Filesize
6.9MB

Download
memory/2320-739-0x0000000010000000-0x0000000010573000-memory.dmp

Filesize
5.4MB

Download
memory/2320-775-0x0000000000820000-0x0000000000F0D000-memory.dmp

Filesize
6.9MB

Download
memory/2320-733-0x0000000001300000-0x00000000019ED000-memory.dmp

Filesize
6.9MB

Download
memory/2320-498-0x0000000000DE0000-0x00000000011D8000-memory.dmp

Filesize
4.0MB

Download
memory/2320-734-0x0000000001300000-0x00000000019ED000-memory.dmp

Filesize
6.9MB

Download
memory/2320-732-0x0000000001300000-0x00000000019ED000-memory.dmp

Filesize
6.9MB

Download
memory/2320-731-0x0000000000820000-0x0000000000F0D000-memory.dmp

Filesize
6.9MB

Download
memory/2320-778-0x0000000001300000-0x00000000019ED000-memory.dmp

Filesize
6.9MB

Download
memory/2320-507-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2320-502-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2320-777-0x0000000001300000-0x00000000019ED000-memory.dmp

Filesize
6.9MB

Download
memory/2320-499-0x0000000000DE0000-0x00000000011D8000-memory.dmp

Filesize
4.0MB

Download
memory/2352-508-0x0000000000FD0000-0x00000000013C8000-memory.dmp

Filesize
4.0MB

Download
memory/2352-511-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2352-510-0x0000000000FD0000-0x00000000013C8000-memory.dmp

Filesize
4.0MB

Download
memory/2352-512-0x0000000000400000-0x0000000000D1C000-memory.dmp

Filesize
9.1MB

Download
memory/2556-24-0x00000000005B0000-0x00000000005F0000-memory.dmp

Filesize
256KB

Download
memory/2556-20-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2556-13-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2556-794-0x0000000006970000-0x0000000006E58000-memory.dmp

Filesize
4.9MB

Download
memory/2556-463-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2556-465-0x00000000005B0000-0x00000000005F0000-memory.dmp

Filesize
256KB

Download
memory/2556-14-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2556-15-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2556-18-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2556-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2556-16-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2556-23-0x0000000073F10000-0x00000000745FE000-memory.dmp

Filesize
6.9MB

Download
memory/2556-22-0x0000000000400000-0x0000000000408000-memory.dmp

Filesize
32KB

Download
memory/2792-524-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2792-532-0x0000000140000000-0x00000001405E8000-memory.dmp

Filesize
5.9MB

Download
memory/2980-681-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/2980-603-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/2980-602-0x0000000000230000-0x000000000024C000-memory.dmp

Filesize
112KB

Download
memory/2980-601-0x0000000000740000-0x0000000000840000-memory.dmp

Filesize
1024KB

Download
memory/2980-605-0x0000000061E00000-0x0000000061EF3000-memory.dmp

Filesize
972KB

Download
memory/2980-683-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download
memory/2980-642-0x0000000000400000-0x000000000062E000-memory.dmp

Filesize
2.2MB

Download