nanocore | 79f7fa86d8dba1349208fa8c36663deb9d6c91a2be54b43d2fc6b7cb78039023

Analysis

max time kernel
117s
max time network
147s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 14:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mille raisons de venir.scr.exe
Size

2.2MB
MD5

ebb76f0ad42d838df23137b3321d79ff
SHA1

946ea76180d53a3049ea7a3b07403ee628b9fac2
SHA256

79f7fa86d8dba1349208fa8c36663deb9d6c91a2be54b43d2fc6b7cb78039023
SHA512

6ae67476a9442ab9b81765e5fd2a43f68f90139568494eac590a95763ba4ed92281994b63a4ad54e0a79c7149550a3bbf329705fa8537847343c148dfdaf61a3
SSDEEP

49152:G+78xSwy+c0Hq9rm2ZHosBnsKXdniYM48E/pa/ZOovp/:Gs8xAJ0K95HBdlM1yQxOoB

Score

10^/10

nanocore evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

e-businessloader.mywire.org:5230

127.0.0.1:5230

Mutex

0be0e5d9-4209-4f88-b4fe-27e7b678a0b5

Attributes

activate_away_mode
true
backup_connection_host
127.0.0.1
backup_dns_server
8.8.4.4
buffer_size
65535
build_time
2024-03-16T21:32:38.702958636Z
bypass_user_account_control
true
bypass_user_account_control_data
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
5230
default_group
e-business
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
0be0e5d9-4209-4f88-b4fe-27e7b678a0b5
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
e-businessloader.mywire.org
primary_dns_server
8.8.8.8
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
true
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
408	START UP56571 HVNCmultipleonlinegahiddenzonline.organiccrap.com.exe

Loads dropped DLL 1 IoCs

pid	Process
2544	Mille raisons de venir.scr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\Notepads = "C:\\Users\\Admin\\AppData\\Roaming\\Notepads.exe"	Mille raisons de venir.scr.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Mille raisons de venir.scr.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	checkip.dyndns.org

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2544 set thread context of 1772	2544	Mille raisons de venir.scr.exe	32
PID 408 set thread context of 2016	408	START UP56571 HVNCmultipleonlinegahiddenzonline.organiccrap.com.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1772	Mille raisons de venir.scr.exe
1772	Mille raisons de venir.scr.exe
1772	Mille raisons de venir.scr.exe
1772	Mille raisons de venir.scr.exe
1772	Mille raisons de venir.scr.exe
1772	Mille raisons de venir.scr.exe
2016	cvtres.exe
2016	cvtres.exe
2016	cvtres.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1772	Mille raisons de venir.scr.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	2544	Mille raisons de venir.scr.exe
Token: SeDebugPrivilege	2544	Mille raisons de venir.scr.exe
Token: SeDebugPrivilege	1772	Mille raisons de venir.scr.exe
Token: SeShutdownPrivilege	2616	explorer.exe
Token: SeShutdownPrivilege	2616	explorer.exe
Token: SeShutdownPrivilege	2616	explorer.exe
Token: SeShutdownPrivilege	2616	explorer.exe
Token: SeShutdownPrivilege	2616	explorer.exe
Token: SeShutdownPrivilege	2616	explorer.exe
Token: SeShutdownPrivilege	2616	explorer.exe
Token: SeShutdownPrivilege	2616	explorer.exe
Token: SeDebugPrivilege	2016	cvtres.exe
Token: SeShutdownPrivilege	2616	explorer.exe
Token: SeShutdownPrivilege	2616	explorer.exe
Token: SeShutdownPrivilege	2616	explorer.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe
2616	explorer.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 408	2544	Mille raisons de venir.scr.exe	31
PID 2544 wrote to memory of 408	2544	Mille raisons de venir.scr.exe	31
PID 2544 wrote to memory of 408	2544	Mille raisons de venir.scr.exe	31
PID 2544 wrote to memory of 408	2544	Mille raisons de venir.scr.exe	31
PID 2544 wrote to memory of 1772	2544	Mille raisons de venir.scr.exe	32
PID 2544 wrote to memory of 1772	2544	Mille raisons de venir.scr.exe	32
PID 2544 wrote to memory of 1772	2544	Mille raisons de venir.scr.exe	32
PID 2544 wrote to memory of 1772	2544	Mille raisons de venir.scr.exe	32
PID 2544 wrote to memory of 1772	2544	Mille raisons de venir.scr.exe	32
PID 2544 wrote to memory of 1772	2544	Mille raisons de venir.scr.exe	32
PID 2544 wrote to memory of 1772	2544	Mille raisons de venir.scr.exe	32
PID 2544 wrote to memory of 1772	2544	Mille raisons de venir.scr.exe	32
PID 2544 wrote to memory of 1772	2544	Mille raisons de venir.scr.exe	32
PID 408 wrote to memory of 2616	408	START UP56571 HVNCmultipleonlinegahiddenzonline.organiccrap.com.exe	33
PID 408 wrote to memory of 2616	408	START UP56571 HVNCmultipleonlinegahiddenzonline.organiccrap.com.exe	33
PID 408 wrote to memory of 2616	408	START UP56571 HVNCmultipleonlinegahiddenzonline.organiccrap.com.exe	33
PID 408 wrote to memory of 2616	408	START UP56571 HVNCmultipleonlinegahiddenzonline.organiccrap.com.exe	33
PID 2616 wrote to memory of 3048	2616	explorer.exe	34
PID 2616 wrote to memory of 3048	2616	explorer.exe	34
PID 2616 wrote to memory of 3048	2616	explorer.exe	34
PID 408 wrote to memory of 2016	408	START UP56571 HVNCmultipleonlinegahiddenzonline.organiccrap.com.exe	35
PID 408 wrote to memory of 2016	408	START UP56571 HVNCmultipleonlinegahiddenzonline.organiccrap.com.exe	35
PID 408 wrote to memory of 2016	408	START UP56571 HVNCmultipleonlinegahiddenzonline.organiccrap.com.exe	35
PID 408 wrote to memory of 2016	408	START UP56571 HVNCmultipleonlinegahiddenzonline.organiccrap.com.exe	35
PID 408 wrote to memory of 2016	408	START UP56571 HVNCmultipleonlinegahiddenzonline.organiccrap.com.exe	35
PID 408 wrote to memory of 2016	408	START UP56571 HVNCmultipleonlinegahiddenzonline.organiccrap.com.exe	35
PID 408 wrote to memory of 2016	408	START UP56571 HVNCmultipleonlinegahiddenzonline.organiccrap.com.exe	35
PID 408 wrote to memory of 2016	408	START UP56571 HVNCmultipleonlinegahiddenzonline.organiccrap.com.exe	35
PID 408 wrote to memory of 2016	408	START UP56571 HVNCmultipleonlinegahiddenzonline.organiccrap.com.exe	35
PID 2016 wrote to memory of 2428	2016	cvtres.exe	36
PID 2016 wrote to memory of 2428	2016	cvtres.exe	36
PID 2016 wrote to memory of 2428	2016	cvtres.exe	36
PID 2016 wrote to memory of 2428	2016	cvtres.exe	36
PID 2428 wrote to memory of 336	2428	cmd.exe	38
PID 2428 wrote to memory of 336	2428	cmd.exe	38
PID 2428 wrote to memory of 336	2428	cmd.exe	38
PID 2428 wrote to memory of 336	2428	cmd.exe	38

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Mille raisons de venir.scr.exe
"C:\Users\Admin\AppData\Local\Temp\Mille raisons de venir.scr.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Local\Temp\START UP56571 HVNCmultipleonlinegahiddenzonline.organiccrap.com.exe
  "C:\Users\Admin\AppData\Local\Temp\START UP56571 HVNCmultipleonlinegahiddenzonline.organiccrap.com.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2616
  - - C:\Windows\system32\ctfmon.exe
      ctfmon.exe
      4⤵
      PID:3048
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2016
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "%FileName%" /tr '"C:\Users\Admin\AppData\Local\Temp\%PathName%\%FileName%"' & exit
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2428
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /f /sc onlogon /rl highest /tn "%FileName%" /tr '"C:\Users\Admin\AppData\Local\Temp\%PathName%\%FileName%"'
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:336
- C:\Users\Admin\AppData\Local\Temp\Mille raisons de venir.scr.exe
  "C:\Users\Admin\AppData\Local\Temp\Mille raisons de venir.scr.exe"
  2⤵
  - Checks whether UAC is enabled
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\START UP56571 HVNCmultipleonlinegahiddenzonline.organiccrap.com.exe

Filesize
81KB

MD5
9b29882a89479f767da3b09801923161

SHA1
2bd104943d235848840e77a36fb008f81525fc56

SHA256
618bb7302570fb60d0710fbdc2123c5c0f969615587652722e4385fa0b5ed966

SHA512
a59240907aa2a12d0d2693f9c8c32a0e4df43d1f7cd5df7d4df5dccf376a618ab280bb8d97a42b3743114710e8a784bea9f0a682b14135fc83b0cdd5c7468b06

Download Submit
memory/408-4944-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download
memory/408-4894-0x00000000001D0000-0x00000000001EA000-memory.dmp

Filesize
104KB

Download
memory/408-4893-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download
memory/408-4897-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download
memory/1772-4924-0x0000000000CE0000-0x0000000000CF4000-memory.dmp

Filesize
80KB

Download
memory/1772-4918-0x0000000000A50000-0x0000000000A5C000-memory.dmp

Filesize
48KB

Download
memory/1772-4925-0x0000000000D30000-0x0000000000D40000-memory.dmp

Filesize
64KB

Download
memory/1772-4922-0x0000000000B80000-0x0000000000B8E000-memory.dmp

Filesize
56KB

Download
memory/1772-4923-0x0000000000CD0000-0x0000000000CDC000-memory.dmp

Filesize
48KB

Download
memory/1772-4927-0x0000000004870000-0x000000000487E000-memory.dmp

Filesize
56KB

Download
memory/1772-4921-0x0000000000B60000-0x0000000000B72000-memory.dmp

Filesize
72KB

Download
memory/1772-4920-0x0000000000AD0000-0x0000000000ADE000-memory.dmp

Filesize
56KB

Download
memory/1772-4919-0x0000000000A60000-0x0000000000A7A000-memory.dmp

Filesize
104KB

Download
memory/1772-4926-0x0000000004860000-0x0000000004874000-memory.dmp

Filesize
80KB

Download
memory/1772-4915-0x00000000007D0000-0x00000000007DA000-memory.dmp

Filesize
40KB

Download
memory/1772-4914-0x00000000007B0000-0x00000000007CE000-memory.dmp

Filesize
120KB

Download
memory/1772-4913-0x0000000000510000-0x000000000051A000-memory.dmp

Filesize
40KB

Download
memory/1772-4911-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/1772-4928-0x0000000004990000-0x00000000049BE000-memory.dmp

Filesize
184KB

Download
memory/1772-4929-0x00000000049C0000-0x00000000049D4000-memory.dmp

Filesize
80KB

Download
memory/2016-4943-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2544-39-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-27-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-23-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-21-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-19-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-15-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-13-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-11-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-9-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-8-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-7-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download
memory/2544-57-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-59-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-61-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-63-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-65-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-67-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-69-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-71-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-4883-0x0000000004940000-0x000000000498C000-memory.dmp

Filesize
304KB

Download
memory/2544-4882-0x00000000052F0000-0x0000000005376000-memory.dmp

Filesize
536KB

Download
memory/2544-4884-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download
memory/2544-4885-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download
memory/2544-25-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-29-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-31-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-4895-0x0000000006000000-0x0000000006054000-memory.dmp

Filesize
336KB

Download
memory/2544-33-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-37-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-4910-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download
memory/2544-0-0x00000000745EE000-0x00000000745EF000-memory.dmp

Filesize
4KB

Download
memory/2544-41-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-45-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-47-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-49-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-51-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-53-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-55-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-43-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-35-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-17-0x00000000068A0000-0x0000000006AE4000-memory.dmp

Filesize
2.3MB

Download
memory/2544-6-0x00000000745EE000-0x00000000745EF000-memory.dmp

Filesize
4KB

Download
memory/2544-5-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download
memory/2544-4-0x00000000068A0000-0x0000000006AEA000-memory.dmp

Filesize
2.3MB

Download
memory/2544-3-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download
memory/2544-2-0x00000000745E0000-0x0000000074CCE000-memory.dmp

Filesize
6.9MB

Download
memory/2544-1-0x0000000000D40000-0x0000000000F70000-memory.dmp

Filesize
2.2MB

Download