nanocore | 0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548

Analysis

max time kernel
151s
max time network
87s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 12:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
Size

469KB
MD5

edab99db8e603fcb1057678eb1ead07a
SHA1

8bb8362a568d809146091b6d5e8872d33e98957f
SHA256

0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548
SHA512

2ff56151059b5ad42d0d2a66f6326e3ef44a98021d31cad6698b810f7ff3e4926a8d61785dd4eda883c5c52d133d63abe9d200ad86d859cc379aa459aacfe5e8
SSDEEP

6144:HBj9qszOXXqrx020vJuCehgE5kXfkTmIPd69gEEGmwHD:hj9qmZ0vQCehgE+fkiIPd6yONHD

Score

10^/10

nanocore keylogger spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.2

lakes14.no-ip.org:9033

lakes14.ddns.me:9033

Mutex

f8a30514-7df5-4771-ba3c-a44135ec6d51

Attributes

activate_away_mode
true
backup_connection_host
lakes14.ddns.me
backup_dns_server
buffer_size
65535
build_time
2015-04-21T07:00:11.899296436Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
true
connect_delay
4000
connection_port
9033
default_group
Money
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
f8a30514-7df5-4771-ba3c-a44135ec6d51
mutex_timeout
5000
prevent_system_sleep
true
primary_connection_host
lakes14.no-ip.org
primary_dns_server
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.2
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Executes dropped EXE 4 IoCs

pid	Process
1632	NcbService.exe
932	CertPropSvc.exe
1896	NcbService.exe
1376	NcbService.exe

Loads dropped DLL 4 IoCs

pid	Process
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
1632	NcbService.exe
932	CertPropSvc.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 864 set thread context of 1796	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	29
PID 932 set thread context of 1088	932	CertPropSvc.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
1796	RegSvcs.exe
1796	RegSvcs.exe
1796	RegSvcs.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
1632	NcbService.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
1632	NcbService.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
1632	NcbService.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
1632	NcbService.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
1632	NcbService.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
1632	NcbService.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
1632	NcbService.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
1632	NcbService.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
1632	NcbService.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
1632	NcbService.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
1632	NcbService.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
932	CertPropSvc.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
932	CertPropSvc.exe
932	CertPropSvc.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
932	CertPropSvc.exe
932	CertPropSvc.exe
864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
932	CertPropSvc.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1796	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
Token: SeDebugPrivilege	1796	RegSvcs.exe
Token: SeDebugPrivilege	1632	NcbService.exe
Token: SeDebugPrivilege	932	CertPropSvc.exe
Token: SeDebugPrivilege	1376	NcbService.exe
Token: SeDebugPrivilege	1896	NcbService.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 1796	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	29
PID 864 wrote to memory of 1796	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	29
PID 864 wrote to memory of 1796	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	29
PID 864 wrote to memory of 1796	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	29
PID 864 wrote to memory of 1796	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	29
PID 864 wrote to memory of 1796	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	29
PID 864 wrote to memory of 1796	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	29
PID 864 wrote to memory of 1796	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	29
PID 864 wrote to memory of 1796	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	29
PID 864 wrote to memory of 1796	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	29
PID 864 wrote to memory of 1796	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	29
PID 864 wrote to memory of 1796	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	29
PID 864 wrote to memory of 1632	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	30
PID 864 wrote to memory of 1632	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	30
PID 864 wrote to memory of 1632	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	30
PID 864 wrote to memory of 1632	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	30
PID 1632 wrote to memory of 932	1632	NcbService.exe	31
PID 1632 wrote to memory of 932	1632	NcbService.exe	31
PID 1632 wrote to memory of 932	1632	NcbService.exe	31
PID 1632 wrote to memory of 932	1632	NcbService.exe	31
PID 932 wrote to memory of 1088	932	CertPropSvc.exe	32
PID 932 wrote to memory of 1088	932	CertPropSvc.exe	32
PID 932 wrote to memory of 1088	932	CertPropSvc.exe	32
PID 932 wrote to memory of 1088	932	CertPropSvc.exe	32
PID 932 wrote to memory of 1088	932	CertPropSvc.exe	32
PID 932 wrote to memory of 1088	932	CertPropSvc.exe	32
PID 932 wrote to memory of 1088	932	CertPropSvc.exe	32
PID 932 wrote to memory of 1088	932	CertPropSvc.exe	32
PID 932 wrote to memory of 1088	932	CertPropSvc.exe	32
PID 932 wrote to memory of 1088	932	CertPropSvc.exe	32
PID 932 wrote to memory of 1088	932	CertPropSvc.exe	32
PID 932 wrote to memory of 1088	932	CertPropSvc.exe	32
PID 932 wrote to memory of 1896	932	CertPropSvc.exe	33
PID 932 wrote to memory of 1896	932	CertPropSvc.exe	33
PID 932 wrote to memory of 1896	932	CertPropSvc.exe	33
PID 932 wrote to memory of 1896	932	CertPropSvc.exe	33
PID 864 wrote to memory of 1376	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	34
PID 864 wrote to memory of 1376	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	34
PID 864 wrote to memory of 1376	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	34
PID 864 wrote to memory of 1376	864	0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe	34

C:\Users\Admin\AppData\Local\Temp\0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe
"C:\Users\Admin\AppData\Local\Temp\0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:864
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1796
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:932
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
      4⤵
      PID:1088
  - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:1896
- C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1376

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe

Filesize
469KB

MD5
edab99db8e603fcb1057678eb1ead07a

SHA1
8bb8362a568d809146091b6d5e8872d33e98957f

SHA256
0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548

SHA512
2ff56151059b5ad42d0d2a66f6326e3ef44a98021d31cad6698b810f7ff3e4926a8d61785dd4eda883c5c52d133d63abe9d200ad86d859cc379aa459aacfe5e8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe

Filesize
469KB

MD5
edab99db8e603fcb1057678eb1ead07a

SHA1
8bb8362a568d809146091b6d5e8872d33e98957f

SHA256
0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548

SHA512
2ff56151059b5ad42d0d2a66f6326e3ef44a98021d31cad6698b810f7ff3e4926a8d61785dd4eda883c5c52d133d63abe9d200ad86d859cc379aa459aacfe5e8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe

Filesize
11KB

MD5
5312cc44b036ff7a413d2b1f2d33f727

SHA1
438d0d79cd3a7835772a7d1fb4472a11b49e87ac

SHA256
8e1c0832c8431809f9fd738b1ddc80e8d6008768f63a5a1a2cc082fe82285f19

SHA512
61a1bd69e8a2f6df5786d95f4cfbcb40e2fcaece4dfad1da9218a2e2660d4687927a394ef6796c46d81971acc67613560803d43545944833b4660d5d6884f95d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe

Filesize
11KB

MD5
5312cc44b036ff7a413d2b1f2d33f727

SHA1
438d0d79cd3a7835772a7d1fb4472a11b49e87ac

SHA256
8e1c0832c8431809f9fd738b1ddc80e8d6008768f63a5a1a2cc082fe82285f19

SHA512
61a1bd69e8a2f6df5786d95f4cfbcb40e2fcaece4dfad1da9218a2e2660d4687927a394ef6796c46d81971acc67613560803d43545944833b4660d5d6884f95d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe

Filesize
11KB

MD5
5312cc44b036ff7a413d2b1f2d33f727

SHA1
438d0d79cd3a7835772a7d1fb4472a11b49e87ac

SHA256
8e1c0832c8431809f9fd738b1ddc80e8d6008768f63a5a1a2cc082fe82285f19

SHA512
61a1bd69e8a2f6df5786d95f4cfbcb40e2fcaece4dfad1da9218a2e2660d4687927a394ef6796c46d81971acc67613560803d43545944833b4660d5d6884f95d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe

Filesize
11KB

MD5
5312cc44b036ff7a413d2b1f2d33f727

SHA1
438d0d79cd3a7835772a7d1fb4472a11b49e87ac

SHA256
8e1c0832c8431809f9fd738b1ddc80e8d6008768f63a5a1a2cc082fe82285f19

SHA512
61a1bd69e8a2f6df5786d95f4cfbcb40e2fcaece4dfad1da9218a2e2660d4687927a394ef6796c46d81971acc67613560803d43545944833b4660d5d6884f95d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe

Filesize
11KB

MD5
5312cc44b036ff7a413d2b1f2d33f727

SHA1
438d0d79cd3a7835772a7d1fb4472a11b49e87ac

SHA256
8e1c0832c8431809f9fd738b1ddc80e8d6008768f63a5a1a2cc082fe82285f19

SHA512
61a1bd69e8a2f6df5786d95f4cfbcb40e2fcaece4dfad1da9218a2e2660d4687927a394ef6796c46d81971acc67613560803d43545944833b4660d5d6884f95d

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\CertPropSvc.exe

Filesize
469KB

MD5
edab99db8e603fcb1057678eb1ead07a

SHA1
8bb8362a568d809146091b6d5e8872d33e98957f

SHA256
0900db546c32091cec689a35b506b024c895ab41fc924ea2285105de0e7bc548

SHA512
2ff56151059b5ad42d0d2a66f6326e3ef44a98021d31cad6698b810f7ff3e4926a8d61785dd4eda883c5c52d133d63abe9d200ad86d859cc379aa459aacfe5e8

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe

Filesize
11KB

MD5
5312cc44b036ff7a413d2b1f2d33f727

SHA1
438d0d79cd3a7835772a7d1fb4472a11b49e87ac

SHA256
8e1c0832c8431809f9fd738b1ddc80e8d6008768f63a5a1a2cc082fe82285f19

SHA512
61a1bd69e8a2f6df5786d95f4cfbcb40e2fcaece4dfad1da9218a2e2660d4687927a394ef6796c46d81971acc67613560803d43545944833b4660d5d6884f95d

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe

Filesize
11KB

MD5
5312cc44b036ff7a413d2b1f2d33f727

SHA1
438d0d79cd3a7835772a7d1fb4472a11b49e87ac

SHA256
8e1c0832c8431809f9fd738b1ddc80e8d6008768f63a5a1a2cc082fe82285f19

SHA512
61a1bd69e8a2f6df5786d95f4cfbcb40e2fcaece4dfad1da9218a2e2660d4687927a394ef6796c46d81971acc67613560803d43545944833b4660d5d6884f95d

Download Submit
\Users\Admin\AppData\Roaming\Microsoft\Windows\NcbService.exe

Filesize
11KB

MD5
5312cc44b036ff7a413d2b1f2d33f727

SHA1
438d0d79cd3a7835772a7d1fb4472a11b49e87ac

SHA256
8e1c0832c8431809f9fd738b1ddc80e8d6008768f63a5a1a2cc082fe82285f19

SHA512
61a1bd69e8a2f6df5786d95f4cfbcb40e2fcaece4dfad1da9218a2e2660d4687927a394ef6796c46d81971acc67613560803d43545944833b4660d5d6884f95d

Download Submit
memory/864-54-0x0000000076261000-0x0000000076263000-memory.dmp

Filesize
8KB

Download
memory/864-56-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/864-55-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/932-82-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/932-85-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/1088-96-0x0000000000090000-0x00000000000C8000-memory.dmp

Filesize
224KB

Download
memory/1376-109-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/1376-107-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/1632-76-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/1632-84-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/1632-86-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/1796-58-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1796-63-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1796-66-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1796-61-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1796-60-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1796-83-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/1796-57-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1796-68-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1796-75-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/1896-106-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download
memory/1896-108-0x0000000074C00000-0x00000000751AB000-memory.dmp

Filesize
5.7MB

Download