nanocore | b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c

Analysis

max time kernel
121s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
18-06-2024 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe
Size

585KB
MD5

41d27d71597c9d1163fb58a816223962
SHA1

2ae197a2724967fb0ae77ee0c20d95d354b9e5cb
SHA256

b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c
SHA512

555aa48eaa46f83933e34c6e8ecaf79c8f1756fb9de79181e4132bc2d02c5789abba90458ad347a374f34fc829f83b36d6666f64a657bf7e99ca5cb9aac2e1a0
SSDEEP

12288:2aYEnxStMSe+LQMNQ7ZQhIyOQSNSY2CNZ+TB29JvNgRh:J/nxSiSCMNQFwt3Jx8gB29Jv2

Score

10^/10

nanocore evasion execution keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

2023endofyear.duckdns.org:15170

127.0.0.1:15170

Mutex

68e7ea47-3f3c-4af7-9707-6d09d0468009

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2023-12-29T09:19:37.611227236Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
false
clear_zone_identifier
false
connect_delay
4000
connection_port
15170
default_group
GLOBAL
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
68e7ea47-3f3c-4af7-9707-6d09d0468009
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
2023endofyear.duckdns.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

2744 powershell.exe
1948 powershell.exe

pid	process
2744	powershell.exe
1948	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NTFS Monitor = "C:\\Program Files (x86)\\NTFS Monitor\\ntfsmon.exe"	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe

description ioc process

Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe

description	pid	process	target process
PID 2156 set thread context of 2684	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe

Drops file in Program Files directory 2 IoCs

Processes:

b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe

description	ioc	process
File created	C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe
File opened for modification	C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence execution

Scheduled Task
T1053.005

Processes:

schtasks.exeschtasks.exeschtasks.exe

pid process

2664 schtasks.exe
2856 schtasks.exe
2988 schtasks.exe

pid	process
2664	schtasks.exe
2856	schtasks.exe
2988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

powershell.exepowershell.exeb4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe

pid	process
1948	powershell.exe
2744	powershell.exe
2684	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe
2684	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe
2684	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe
2684	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe
2684	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe

pid process

2684 b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe
Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exeb4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe

description pid process

Token: SeDebugPrivilege 1948 powershell.exe
Token: SeDebugPrivilege 2744 powershell.exe
Token: SeDebugPrivilege 2684 b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe

pid	process
2684	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe

description	pid	process
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	2744	powershell.exe
Token: SeDebugPrivilege	2684	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe

Suspicious use of WriteProcessMemory 29 IoCs

Processes:

b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exeb4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe

description	pid	process	target process
PID 2156 wrote to memory of 2744	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	powershell.exe
PID 2156 wrote to memory of 2744	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	powershell.exe
PID 2156 wrote to memory of 2744	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	powershell.exe
PID 2156 wrote to memory of 2744	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	powershell.exe
PID 2156 wrote to memory of 1948	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	powershell.exe
PID 2156 wrote to memory of 1948	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	powershell.exe
PID 2156 wrote to memory of 1948	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	powershell.exe
PID 2156 wrote to memory of 1948	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	powershell.exe
PID 2156 wrote to memory of 2664	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	schtasks.exe
PID 2156 wrote to memory of 2664	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	schtasks.exe
PID 2156 wrote to memory of 2664	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	schtasks.exe
PID 2156 wrote to memory of 2664	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	schtasks.exe
PID 2156 wrote to memory of 2684	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe
PID 2156 wrote to memory of 2684	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe
PID 2156 wrote to memory of 2684	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe
PID 2156 wrote to memory of 2684	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe
PID 2156 wrote to memory of 2684	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe
PID 2156 wrote to memory of 2684	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe
PID 2156 wrote to memory of 2684	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe
PID 2156 wrote to memory of 2684	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe
PID 2156 wrote to memory of 2684	2156	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe
PID 2684 wrote to memory of 2856	2684	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	schtasks.exe
PID 2684 wrote to memory of 2856	2684	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	schtasks.exe
PID 2684 wrote to memory of 2856	2684	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	schtasks.exe
PID 2684 wrote to memory of 2856	2684	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	schtasks.exe
PID 2684 wrote to memory of 2988	2684	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	schtasks.exe
PID 2684 wrote to memory of 2988	2684	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	schtasks.exe
PID 2684 wrote to memory of 2988	2684	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	schtasks.exe
PID 2684 wrote to memory of 2988	2684	b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe
"C:\Users\Admin\AppData\Local\Temp\b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2156

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2744

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dsiayzgxX.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1948

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dsiayzgxX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4EDB.tmp"
2⤵
- Scheduled Task/Job: Scheduled Task
PID:2664

C:\Users\Admin\AppData\Local\Temp\b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe
"C:\Users\Admin\AppData\Local\Temp\b4a76ec2287a65963ea978ae7911b8c42c3411a21c995463985599d975e9960c.exe"
2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "NTFS Monitor" /xml "C:\Users\Admin\AppData\Local\Temp\tmp50A0.tmp"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2856

C:\Windows\SysWOW64\schtasks.exe
"schtasks.exe" /create /f /tn "NTFS Monitor Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp512D.tmp"
3⤵
- Scheduled Task/Job: Scheduled Task
PID:2988

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4EDB.tmp
Filesize
1KB

MD5
451694b44e16d20ee1f298da96dd0f58

SHA1
f308d663153469403ce358febf4cbf6f408acccc

SHA256
99646a20b2de3494907c71a8d2b2c616af68513bade2e0cafc6af49869d8b8b1

SHA512
4e61a15db53137ea569aff1472dd6747b208ef383f0c8c87610351708efd5a452e48a939a96ce16d287ab5fc7de14123a163fc3807a0a0983ee8858365221566

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp50A0.tmp
Filesize
1KB

MD5
cabdc89a33b52830601190421a4838a9

SHA1
94fc2d24b510c8f19ad2cda8f391e5893666ae68

SHA256
273dd05dea08a08008bbcc67b4fc726817a87c270fdccb97319a990869905b99

SHA512
b3273af6953c6e01a327faa305478f54c3a0528c1853d8e7c517ba6d616f8850ee9d9ecaaaa5896ce8584d63e911a59af5e24df94e0b2f4ee100b12f3b2de965

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp512D.tmp
Filesize
1KB

MD5
981e126601526eaa5b0ad45c496c4465

SHA1
d610d6a21a8420cc73fcd3e54ddae75a5897b28b

SHA256
11ae277dfa39e7038b782ca6557339e7fe88533fe83705c356a1500a1402d527

SHA512
a59fb704d931ccb7e1ec1a7b98e24ccd8708be529066c6de4b673098cdebef539f7f50d9e051c43954b5a8e7f810862b3a4ede170f131e080dadc3e763ed4bdb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
679eefca1a23f2ab37681d9c1766c9ba

SHA1
cf4c7a3f5b378f8d41d05369321efd2e1105966c

SHA256
6f9ff78ed3442016976e11e1ec80b8692cb390f781da50e8acffef28e5a2c627

SHA512
813d699220721b1132d141faa93ceb9f5567d45db40336448d392d5ba7392a1f14b159fec0c6119144fd0107e5122bac05a348745aeb7ea1bab0b66b4967a9f2

Download Submit
memory/2156-31-0x0000000074D00000-0x00000000753EE000-memory.dmp

Filesize
6.9MB

Download
memory/2156-1-0x0000000000DB0000-0x0000000000E48000-memory.dmp

Filesize
608KB

Download
memory/2156-2-0x0000000074D00000-0x00000000753EE000-memory.dmp

Filesize
6.9MB

Download
memory/2156-3-0x00000000004B0000-0x00000000004C4000-memory.dmp

Filesize
80KB

Download
memory/2156-4-0x00000000004E0000-0x00000000004E8000-memory.dmp

Filesize
32KB

Download
memory/2156-5-0x0000000000540000-0x000000000054C000-memory.dmp

Filesize
48KB

Download
memory/2156-6-0x0000000000B50000-0x0000000000BCC000-memory.dmp

Filesize
496KB

Download
memory/2156-0-0x0000000074D0E000-0x0000000074D0F000-memory.dmp

Filesize
4KB

Download
memory/2684-19-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2684-42-0x00000000006E0000-0x00000000006EA000-memory.dmp

Filesize
40KB

Download
memory/2684-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2684-25-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2684-23-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2684-29-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2684-30-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2684-21-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2684-39-0x0000000000460000-0x000000000046A000-memory.dmp

Filesize
40KB

Download
memory/2684-40-0x00000000004B0000-0x00000000004BC000-memory.dmp

Filesize
48KB

Download
memory/2684-41-0x00000000006B0000-0x00000000006CE000-memory.dmp

Filesize
120KB

Download
memory/2684-28-0x0000000000400000-0x000000000043A000-memory.dmp

Filesize
232KB

Download
memory/2684-45-0x0000000000770000-0x0000000000782000-memory.dmp

Filesize
72KB

Download
memory/2684-46-0x00000000007C0000-0x00000000007DA000-memory.dmp

Filesize
104KB

Download
memory/2684-47-0x0000000000830000-0x000000000083E000-memory.dmp

Filesize
56KB

Download
memory/2684-49-0x0000000000860000-0x000000000086E000-memory.dmp

Filesize
56KB

Download
memory/2684-48-0x0000000000850000-0x0000000000862000-memory.dmp

Filesize
72KB

Download
memory/2684-50-0x0000000000930000-0x000000000093C000-memory.dmp

Filesize
48KB

Download
memory/2684-51-0x0000000000C70000-0x0000000000C84000-memory.dmp

Filesize
80KB

Download
memory/2684-52-0x0000000000C80000-0x0000000000C90000-memory.dmp

Filesize
64KB

Download
memory/2684-53-0x0000000000D90000-0x0000000000DA4000-memory.dmp

Filesize
80KB

Download
memory/2684-54-0x0000000002330000-0x000000000233E000-memory.dmp

Filesize
56KB

Download
memory/2684-55-0x00000000023A0000-0x00000000023CE000-memory.dmp

Filesize
184KB

Download
memory/2684-56-0x0000000002350000-0x0000000002364000-memory.dmp

Filesize
80KB

Download