nanocore | 82f425150e933ae4f1f3174cf68bbfdb0e8ed8767b511e80ff95595881c9867b

Analysis

max time kernel
140s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-12-2024 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe
Size

445KB
MD5

c5052a4af2f30bb484ed1814798b3348
SHA1

e1b3256191cd19bbb654667a9a2f1ae2218bd221
SHA256

82f425150e933ae4f1f3174cf68bbfdb0e8ed8767b511e80ff95595881c9867b
SHA512

5283d6182f50d2332025f8310604478379d34c34effd300f3ab18752e20ce96b41eb2f45b582e67d73ee2c1e3387479029f7620f84d149886f4a0fe4bae503c9
SSDEEP

12288:D0aTjl7CIIf7lfoQpxmk/9z92FQI8n42ru:RTjlGIIfB5pQIfo8n42C

Score

10^/10

nanocore discovery evasion keylogger persistence spyware stealer trojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

195.242.110.183:5654

Mutex

91612fd5-69d9-4114-9ab3-91d748463d48

Attributes

activate_away_mode
true
backup_connection_host
195.242.110.183
backup_dns_server
195.242.110.183
buffer_size
65535
build_time
2021-05-21T07:22:15.520160336Z
bypass_user_account_control
false
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
clear_access_control
true
clear_zone_identifier
false
connect_delay
4000
connection_port
5654
default_group
Default
enable_debug_mode
true
gc_threshold
1.048576e+07
keep_alive_timeout
30000
keyboard_logging
false
lan_timeout
2500
max_packet_size
1.048576e+07
mutex
91612fd5-69d9-4114-9ab3-91d748463d48
mutex_timeout
5000
prevent_system_sleep
false
primary_connection_host
195.242.110.183
primary_dns_server
195.242.110.183
request_elevation
true
restart_delay
5000
run_delay
0
run_on_startup
false
set_critical_process
true
timeout_interval
5000
use_custom_dns_server
false
version
1.2.2.0
wan_timeout
8000

Signatures

NanoCore
NanoCore is a remote access tool (RAT) with a variety of capabilities.
keylogger trojan stealer spyware nanocore
Nanocore family
nanocore

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Service = "C:\\Program Files (x86)\\DHCP Service\\dhcpsvc.exe"	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4720 set thread context of 3004	4720	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	100

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\DHCP Service\dhcpsvc.exe	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\DHCP Service\dhcpsvc.exe	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5864	schtasks.exe
3672	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1360	powershell.exe
1360	powershell.exe
4840	powershell.exe
4840	powershell.exe
4720	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe
4720	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe
3004	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe
3004	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe
3004	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3004	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeIncreaseQuotaPrivilege	1360	powershell.exe
Token: SeSecurityPrivilege	1360	powershell.exe
Token: SeTakeOwnershipPrivilege	1360	powershell.exe
Token: SeLoadDriverPrivilege	1360	powershell.exe
Token: SeSystemProfilePrivilege	1360	powershell.exe
Token: SeSystemtimePrivilege	1360	powershell.exe
Token: SeProfSingleProcessPrivilege	1360	powershell.exe
Token: SeIncBasePriorityPrivilege	1360	powershell.exe
Token: SeCreatePagefilePrivilege	1360	powershell.exe
Token: SeBackupPrivilege	1360	powershell.exe
Token: SeRestorePrivilege	1360	powershell.exe
Token: SeShutdownPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeSystemEnvironmentPrivilege	1360	powershell.exe
Token: SeRemoteShutdownPrivilege	1360	powershell.exe
Token: SeUndockPrivilege	1360	powershell.exe
Token: SeManageVolumePrivilege	1360	powershell.exe
Token: 33	1360	powershell.exe
Token: 34	1360	powershell.exe
Token: 35	1360	powershell.exe
Token: 36	1360	powershell.exe
Token: SeIncreaseQuotaPrivilege	1360	powershell.exe
Token: SeSecurityPrivilege	1360	powershell.exe
Token: SeTakeOwnershipPrivilege	1360	powershell.exe
Token: SeLoadDriverPrivilege	1360	powershell.exe
Token: SeSystemProfilePrivilege	1360	powershell.exe
Token: SeSystemtimePrivilege	1360	powershell.exe
Token: SeProfSingleProcessPrivilege	1360	powershell.exe
Token: SeIncBasePriorityPrivilege	1360	powershell.exe
Token: SeCreatePagefilePrivilege	1360	powershell.exe
Token: SeBackupPrivilege	1360	powershell.exe
Token: SeRestorePrivilege	1360	powershell.exe
Token: SeShutdownPrivilege	1360	powershell.exe
Token: SeDebugPrivilege	1360	powershell.exe
Token: SeSystemEnvironmentPrivilege	1360	powershell.exe
Token: SeRemoteShutdownPrivilege	1360	powershell.exe
Token: SeUndockPrivilege	1360	powershell.exe
Token: SeManageVolumePrivilege	1360	powershell.exe
Token: 33	1360	powershell.exe
Token: 34	1360	powershell.exe
Token: 35	1360	powershell.exe
Token: 36	1360	powershell.exe
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeIncreaseQuotaPrivilege	4840	powershell.exe
Token: SeSecurityPrivilege	4840	powershell.exe
Token: SeTakeOwnershipPrivilege	4840	powershell.exe
Token: SeLoadDriverPrivilege	4840	powershell.exe
Token: SeSystemProfilePrivilege	4840	powershell.exe
Token: SeSystemtimePrivilege	4840	powershell.exe
Token: SeProfSingleProcessPrivilege	4840	powershell.exe
Token: SeIncBasePriorityPrivilege	4840	powershell.exe
Token: SeCreatePagefilePrivilege	4840	powershell.exe
Token: SeBackupPrivilege	4840	powershell.exe
Token: SeRestorePrivilege	4840	powershell.exe
Token: SeShutdownPrivilege	4840	powershell.exe
Token: SeDebugPrivilege	4840	powershell.exe
Token: SeSystemEnvironmentPrivilege	4840	powershell.exe
Token: SeRemoteShutdownPrivilege	4840	powershell.exe
Token: SeUndockPrivilege	4840	powershell.exe
Token: SeManageVolumePrivilege	4840	powershell.exe
Token: 33	4840	powershell.exe
Token: 34	4840	powershell.exe
Token: 35	4840	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 1360	4720	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	83
PID 4720 wrote to memory of 1360	4720	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	83
PID 4720 wrote to memory of 1360	4720	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	83
PID 4720 wrote to memory of 4840	4720	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	91
PID 4720 wrote to memory of 4840	4720	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	91
PID 4720 wrote to memory of 4840	4720	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	91
PID 4720 wrote to memory of 3004	4720	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	100
PID 4720 wrote to memory of 3004	4720	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	100
PID 4720 wrote to memory of 3004	4720	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	100
PID 4720 wrote to memory of 3004	4720	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	100
PID 4720 wrote to memory of 3004	4720	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	100
PID 4720 wrote to memory of 3004	4720	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	100
PID 4720 wrote to memory of 3004	4720	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	100
PID 4720 wrote to memory of 3004	4720	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	100
PID 3004 wrote to memory of 3672	3004	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	101
PID 3004 wrote to memory of 3672	3004	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	101
PID 3004 wrote to memory of 3672	3004	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	101
PID 3004 wrote to memory of 5864	3004	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	103
PID 3004 wrote to memory of 5864	3004	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	103
PID 3004 wrote to memory of 5864	3004	c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe	103

C:\Users\Admin\AppData\Local\Temp\c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1360
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection 8.8.8.8
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4840
- C:\Users\Admin\AppData\Local\Temp\c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe
  C:\Users\Admin\AppData\Local\Temp\c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe
  2⤵
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "DHCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE9A4.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3672
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /create /f /tn "DHCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpEA03.tmp"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\c5052a4af2f30bb484ed1814798b3348_JaffaCakes118.exe.log

Filesize
1KB

MD5
7ebe314bf617dc3e48b995a6c352740c

SHA1
538f643b7b30f9231a3035c448607f767527a870

SHA256
48178f884b8a4dd96e330b210b0530667d9473a7629fc6b4ad12b614bf438ee8

SHA512
0ba9d8f4244c15285e254d27b4bff7c49344ff845c48bc0bf0d8563072fab4d6f7a6abe6b6742e8375a08e9a3b3e5d5dc4937ab428dbe2dd8e62892fda04507e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
0774a05ce5ee4c1af7097353c9296c62

SHA1
658ff96b111c21c39d7ad5f510fb72f9762114bb

SHA256
d9c5347ed06755feeb0615f1671f6b91e2718703da0dbc4b0bd205cbd2896dd4

SHA512
104d69fc4f4aaa5070b78ada130228939c7e01436351166fe51fe2da8a02f9948e6d92dd676f62820da1813872b91411e2f863c9a98a760581ec34d4aa354994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
19KB

MD5
788d1c0231c39c83b355f003b2aaafac

SHA1
c839244e69e1765577ad67024ea131ef96bd97cc

SHA256
71f776ed11e5fdff9d51c197cea44a0a1fddc04b06f47eaac7623f1fc3036383

SHA512
2933a8c20a8d14c4a108e3e97bf2f25ab98d15d06bb28f177c264c61237d4d50a658ea6c540d014e7cdf90624367617f5bfbce9665c4866c7864462605d71e52

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3le2zchr.1dp.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpE9A4.tmp

Filesize
1KB

MD5
e6a32e0c3c2d508fbceb4b4c35aef127

SHA1
03aec97f485fb9d33989f74683f8a191cd747187

SHA256
e530569890d87203f16610bfc5cac4a47ce2fba5ef7ec5f3f12e806bd92f4582

SHA512
d2f8c2a604c98c259096e4e262bcd1079975d5d52ac6e750e74e37ab27bd622c5e7a89b35f1e5ea7943b8dbc001591a8645c835f2d01e795337e7f8b026fd58e

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpEA03.tmp

Filesize
1KB

MD5
7f4b37265a0a4b0fea67999d11d911e8

SHA1
1b8e13e6a27c3768c30cf713b79eaa8a757e1349

SHA256
39b16b3a00b6b43c6820357127228c0768a577153014ce7b0ea3c585244dc08b

SHA512
ef97ccfb663555aedc7fdc4b3ac4cd6536c80a778b4ec3bc6124a09544733988de1dac1e6a3714b0d6e8713e3523e0732d5dfcf674f2c5e1f3eadacb0c8e5e03

Download Submit
memory/1360-25-0x0000000006010000-0x000000000605C000-memory.dmp

Filesize
304KB

Download
memory/1360-26-0x0000000006FD0000-0x0000000007066000-memory.dmp

Filesize
600KB

Download
memory/1360-14-0x0000000005A00000-0x0000000005D54000-memory.dmp

Filesize
3.3MB

Download
memory/1360-11-0x0000000005280000-0x00000000052E6000-memory.dmp

Filesize
408KB

Download
memory/1360-13-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/1360-24-0x0000000005F80000-0x0000000005F9E000-memory.dmp

Filesize
120KB

Download
memory/1360-10-0x00000000050E0000-0x0000000005102000-memory.dmp

Filesize
136KB

Download
memory/1360-8-0x00000000053D0000-0x00000000059F8000-memory.dmp

Filesize
6.2MB

Download
memory/1360-27-0x00000000064B0000-0x00000000064CA000-memory.dmp

Filesize
104KB

Download
memory/1360-28-0x0000000006500000-0x0000000006522000-memory.dmp

Filesize
136KB

Download
memory/1360-29-0x0000000008250000-0x00000000088CA000-memory.dmp

Filesize
6.5MB

Download
memory/1360-32-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/1360-7-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/1360-12-0x00000000052F0000-0x0000000005356000-memory.dmp

Filesize
408KB

Download
memory/1360-6-0x0000000002690000-0x00000000026C6000-memory.dmp

Filesize
216KB

Download
memory/1360-9-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/3004-2135-0x0000000006700000-0x000000000670A000-memory.dmp

Filesize
40KB

Download
memory/3004-2123-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download
memory/3004-2125-0x0000000005540000-0x00000000055DC000-memory.dmp

Filesize
624KB

Download
memory/3004-2133-0x0000000006530000-0x000000000653A000-memory.dmp

Filesize
40KB

Download
memory/3004-2134-0x00000000065C0000-0x00000000065DE000-memory.dmp

Filesize
120KB

Download
memory/4720-111-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-81-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-0-0x0000000074F0E000-0x0000000074F0F000-memory.dmp

Filesize
4KB

Download
memory/4720-1-0x0000000000D90000-0x0000000000E06000-memory.dmp

Filesize
472KB

Download
memory/4720-2-0x0000000005E40000-0x00000000063E4000-memory.dmp

Filesize
5.6MB

Download
memory/4720-52-0x0000000006A60000-0x0000000006AC8000-memory.dmp

Filesize
416KB

Download
memory/4720-53-0x0000000007560000-0x00000000075CC000-memory.dmp

Filesize
432KB

Download
memory/4720-61-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-67-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-117-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-115-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-3-0x0000000005890000-0x0000000005922000-memory.dmp

Filesize
584KB

Download
memory/4720-109-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-107-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-105-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-103-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-101-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-99-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-95-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-93-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-91-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-89-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-88-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-86-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-83-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-4-0x0000000005970000-0x000000000597A000-memory.dmp

Filesize
40KB

Download
memory/4720-79-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-77-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-75-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-73-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-71-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-65-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-63-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-113-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-97-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-70-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-59-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-57-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-55-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-54-0x0000000007560000-0x00000000075C6000-memory.dmp

Filesize
408KB

Download
memory/4720-34-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/4720-33-0x0000000074F0E000-0x0000000074F0F000-memory.dmp

Filesize
4KB

Download
memory/4720-2124-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/4720-5-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/4840-38-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/4840-36-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/4840-51-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/4840-37-0x0000000074F00000-0x00000000756B0000-memory.dmp

Filesize
7.7MB

Download
memory/4840-48-0x0000000005EF0000-0x0000000006244000-memory.dmp

Filesize
3.3MB

Download