Overview

overview

10

Static

static

3

86073e6097...f2.exe

windows7-x64

10

86073e6097...f2.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    140s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    06/03/2025, 17:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    86073e6097e1ff9e879b0eb493f173f2.exe

  • Size

    726KB

  • MD5

    86073e6097e1ff9e879b0eb493f173f2

  • SHA1

    f06a1f7c37604244a80c61a2a22d1686f05626d9

  • SHA256

    c3e019a0502617286408630187c0e19eb146ee3d70e0b9e0390d9e3763e041bc

  • SHA512

    f3ef06f22a8c0d0894e66a25a1f6eca5d8243103b914001a430b3388d34f8c395c320c2e5827ed56c881f52added7461979211c474ebc8444e03610249fe7725

  • SSDEEP

    12288:x/Sp50g7ZeK50g7M1ogf3OKoHdML29Tod5iJRZbvLgC5cJnY/XUr6xIgno8g50g7:Yp5F7AK5F7w/rL5iNbv7OsUr6xIgno5T

Score
10/10
nanocorexwormdefense_evasiondiscoveryexecutionkeyloggerpersistenceratspywarestealertrojan

Malware Config

Extracted

Family

nanocore

Version

1.2.2.0

C2

elroithegodofnsppd.duckdns.org:43366

elroithegodofnsppd.ddnsfree.com:43366
Mutex

4991469e-2d84-4048-8aed-20a53304961e

Attributes
  • activate_away_mode

    false

  • backup_connection_host

    elroithegodofnsppd.ddnsfree.com

  • backup_dns_server

  • buffer_size

    65538

  • build_time

    2024-12-06T15:16:37.862063536Z

  • bypass_user_account_control

    false

  • bypass_user_account_control_data

    PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+

  • clear_access_control

    false

  • clear_zone_identifier

    false

  • connect_delay

    4000

  • connection_port

    43366

  • default_group

    EROI MY GOD

  • enable_debug_mode

    true

  • gc_threshold

    1.0485772e+07

  • keep_alive_timeout

    30000

  • keyboard_logging

    false

  • lan_timeout

    2500

  • max_packet_size

    1.0485772e+07

  • mutex

    4991469e-2d84-4048-8aed-20a53304961e

  • mutex_timeout

    5000

  • prevent_system_sleep

    false

  • primary_connection_host

    elroithegodofnsppd.duckdns.org

  • primary_dns_server

  • request_elevation

    true

  • restart_delay

    5000

  • run_delay

    0

  • run_on_startup

    false

  • set_critical_process

    false

  • timeout_interval

    5000

  • use_custom_dns_server

    false

  • version

    1.2.2.0

  • wan_timeout

    8009

Extracted

Family

xworm

Version

5.0

C2

tunhost.duckdns.org:57891

wintun.freemyip.com:57891

87.249.134.68:57891
Attributes
  • install_file

    琀㴀Ā ☀☀ �䔗渀瘀椀爀漀渀洀攀渀琀�眍椀渀搀椀爀�瀝漀眀攀爀猀栀攀氀氀⸀攀砀攀�醀-C schtasks.exe

aes.plain

Signatures

  • Detect Xworm Payload 3 IoCs
  • NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Nanocore family
    nanocore
  • UAC bypass 3 TTPs 1 IoCs
    defense_evasiontrojan
  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm
  • Xworm family
    xworm
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks BIOS information in registry 2 TTPs 1 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    defense_evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 13 IoCs
    defense_evasionspywaretrojan
  • Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 21 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\86073e6097e1ff9e879b0eb493f173f2.exe
    "C:\Users\Admin\AppData\Local\Temp\86073e6097e1ff9e879b0eb493f173f2.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2808
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\86073e6097e1ff9e879b0eb493f173f2.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2920
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AOhdPA.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2708
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AOhdPA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA110.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2672
    • C:\Users\Admin\AppData\Local\Temp\86073e6097e1ff9e879b0eb493f173f2.exe
      "C:\Users\Admin\AppData\Local\Temp\86073e6097e1ff9e879b0eb493f173f2.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Adds Run key to start application
      • Checks whether UAC is enabled
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:784
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /create /f /tn "WPA Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA728.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2300
      • C:\Windows\SysWOW64\schtasks.exe
        "schtasks.exe" /create /f /tn "WPA Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpA7F4.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:2112
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe"
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Checks whether UAC is enabled
        • System Location Discovery: System Language Discovery
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious behavior: SetClipboardViewer
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2864
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /delete /f /tn "Microsoft\Windows\Client Server Runtime Process"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2276
        • C:\Windows\SysWOW64\schtasks.exe
          "schtasks.exe" /create /f /tn "Microsoft\Windows\Client Server Runtime Process" /xml "C:\Users\Admin\AppData\Local\Temp\tmp6587.tmp"
          4⤵
          • System Location Discovery: System Language Discovery
          • Scheduled Task/Job: Scheduled Task
          PID:2960
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wanhost.exe
        "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wanhost.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2796
      • C:\Windows\SysWOW64\reg.exe
        "reg.exe" ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f
        3⤵
        • UAC bypass
        • System Location Discovery: System Language Discovery
        • Modifies registry key
        PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

4
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Web Service

1
T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
    Filesize

    71KB

    MD5

    83142242e97b8953c386f988aa694e4a

    SHA1

    833ed12fc15b356136dcdd27c61a50f59c5c7d50

    SHA256

    d72761e1a334a754ce8250e3af7ea4bf25301040929fd88cf9e50b4a9197d755

    SHA512

    bb6da177bd16d163f377d9b4c63f6d535804137887684c113cc2f643ceab4f34338c06b5a29213c23d375e95d22ef417eac928822dfb3688ce9e2de9d5242d10

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    a8a6c3488c100c730c80bba12ca34e74

    SHA1

    1febf9703e12f51902a0970ab76b4d09957b899a

    SHA256

    ab9719070a01d99de1972924f970db09c2a98a2d96458537a8af7f6cb3dbc9cc

    SHA512

    591ace93865b3e02fa9903b4c8b5a781bf3d99d04e1860a7b5094ec4f8161f45209f908fb85cb831a86e5fce832b7e14bd062d029bcad488b0d189954d8920c9

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    dc1a62c3fe7b5ff3fc978db3dd8a55a3

    SHA1

    5dd4b4b26457764b8afbbfa6bdd3c30624be82b5

    SHA256

    3ef053af996056bdd6a04b9054e7d336f4c065392b48b29309a7f86a7f53a8ce

    SHA512

    b3d5d7bead1f16065e2490ad97804e6b35e2ba5ae103f021bc9b46de0008794a609609e336b98c8c4024869717e1aaad7ef6277a8d746520ec9340fa66263c1f

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    344B

    MD5

    177c890faa61c5b01611edc1c15cc680

    SHA1

    01d623bf1d16864e55666dffccf874139c6d553a

    SHA256

    caa180954e0b6a61b3e2f9887266ac16374dfbaee543449d148081197369822d

    SHA512

    cc3c0b6d5f669ddd369a7711cd57cbb06f2b41e49f6b4dcc672402296ba40fc11e64e2fdccc3624607b03014a9222c8543b78cc6cbbe86756df327be633c82e3

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\Tar5CD9.tmp
    Filesize

    183KB

    MD5

    109cab5505f5e065b63d01361467a83b

    SHA1

    4ed78955b9272a9ed689b51bf2bf4a86a25e53fc

    SHA256

    ea6b7f51e85835c09259d9475a7d246c3e764ad67c449673f9dc97172c351673

    SHA512

    753a6da5d6889dd52f40208e37f2b8c185805ef81148682b269fff5aa84a46d710fe0ebfe05bce625da2e801e1c26745998a41266fa36bf47bc088a224d730cc

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmp6587.tmp
    Filesize

    1KB

    MD5

    55f737e134714dd479fb8d4417a14df5

    SHA1

    4195b4131fb1215140baaaf5a6d8e26f305572af

    SHA256

    f306ee4e70a9dd3281131c476541b78f8cbe387a8a507f3b98a48ef34ecf2835

    SHA512

    446fa2af1cfb7057fd96fbaa26b4dcec67427399c8859c85ed11d5fb7b64f6abca39581faa2f17ca32c5e57759a448266d4be6af39e730d5e596cc41701fd1bf

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpA110.tmp
    Filesize

    1KB

    MD5

    7ade0b44b1041930b5c9a1e781f34a31

    SHA1

    19240bae536a89f3c5fa5818331098d81689a2af

    SHA256

    99691a618d9a6b75730a4db725b91ea68376d6c4c5c25fee1b370ee38ca3f1d3

    SHA512

    2e579b4750c5e4f7a8695687be6e860c877665f005fa5ee9b7bd528d6c9ce1e85275311553fc70a37052c859ad761796ef2a76e3c862fdc77ea7a4eb09ee9603

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpA728.tmp
    Filesize

    1KB

    MD5

    7e7e4a390fe8f14dadd0e9ff2bfc5dc0

    SHA1

    8aa3bb41f555d92aab1e917ba5eaf03b96d05017

    SHA256

    90344f0ce614dee4fb8bec55db91e7bc34efb2ab507e94083df006b98b0ff534

    SHA512

    cb1cd9e8938e877bf476dcec09bdbc00ec6e89695a1c0bb3a35c73dd2f61af40bec7d48c6c58c1201eef108a458f68804de497dafcdd5a25b2a672745841429b

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpA7F4.tmp
    Filesize

    1KB

    MD5

    21de6c3a6440d917bdbb4b491191d9b2

    SHA1

    c63c300affe7147910dc4544d2d5f3029bf321a6

    SHA256

    23af17733a3882cdd82a5bbc321d896b2430dc1bb4b4ac034d129cde5027afc4

    SHA512

    dcd1c464ed36593b990e072940ab415804ef8076743015fff4939211e30e436beb7ce6af3072769abe0214f737cedb210d2b45e6e90da20dac54c3945b11575f

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\Z9S9IAI357HE1YRL6U5P.temp
    Filesize

    7KB

    MD5

    0b315993f8a823a4a297082058f63817

    SHA1

    4d28fbab7c2056c17ca8954f750e071a4c1b5822

    SHA256

    fe71fa8432106d0ae2dcce20aa281c278987d2bedcbfc4aab9b6ab57ac9fc6df

    SHA512

    4dd9ab023eaac597dcfc0ef0cd76de36df4ae322ad28dbc8f114c9eb2aeba557b1cac0de6643a7c63a8cecbb9dd85be2fc525456cbcede449b2dccc9b7aaaa98

    Download Submit

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wanhost.exe
    Filesize

    32KB

    MD5

    bb88af07d7f92e77086eb2a090b508fd

    SHA1

    2fcf43147b61ed5c8e1d7d46398eb3749e649e78

    SHA256

    77ce6f10d6034a1d7ab7768278cf8322b719729f612e6afe8cff72cb637cd6ec

    SHA512

    7a41def72de640dbf057c41971b02213e75202a1863b41491e36644da17bcbfb16c41ae6c6af121b5b2f7fee4f0608f867a404f1bbbf8db5dc9444978868f7c3

    Download Submit

  • \Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogon.exe
    Filesize

    191KB

    MD5

    ed3b00caa7c83ab730df4a14aeb5d6bf

    SHA1

    453eeebd3cd4a0faf5e7eca63ea6cdb0ed96971a

    SHA256

    456b4cf130884ff7283aa415425ff6e3f6c610211bc7504e41bba9346dacd827

    SHA512

    fb64f0d53215cfcbd18f9de977e2f41323192b9329e67f7c26f53692970a2688f0a6a80f836c073945404e84364620f49790b22499bbf65c904341b90ccba954

    Download Submit

  • memory/784-19-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

    Download

  • memory/784-40-0x00000000003E0000-0x00000000003FE000-memory.dmp

    Filesize

    120KB

    Download

  • memory/784-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

    Download

  • memory/784-23-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

    Download

  • memory/784-21-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

    Download

  • memory/784-26-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

    Download

  • memory/784-29-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

    Download

  • memory/784-28-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

    Download

  • memory/784-39-0x00000000003D0000-0x00000000003DA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/784-30-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

    Download

  • memory/784-41-0x00000000004E0000-0x00000000004EA000-memory.dmp

    Filesize

    40KB

    Download

  • memory/784-44-0x0000000000510000-0x0000000000522000-memory.dmp

    Filesize

    72KB

    Download

  • memory/784-45-0x0000000000580000-0x000000000059A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/784-46-0x00000000005A0000-0x00000000005B2000-memory.dmp

    Filesize

    72KB

    Download

  • memory/784-47-0x0000000000600000-0x000000000060E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/784-48-0x0000000000B10000-0x0000000000B54000-memory.dmp

    Filesize

    272KB

    Download

  • memory/2796-219-0x0000000000D40000-0x0000000000D4E000-memory.dmp

    Filesize

    56KB

    Download

  • memory/2808-31-0x0000000073F60000-0x000000007464E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2808-6-0x0000000005500000-0x000000000557E000-memory.dmp

    Filesize

    504KB

    Download

  • memory/2808-5-0x0000000073F60000-0x000000007464E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2808-4-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2808-0-0x0000000073F6E000-0x0000000073F6F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2808-3-0x0000000000A50000-0x0000000000A68000-memory.dmp

    Filesize

    96KB

    Download

  • memory/2808-2-0x0000000073F60000-0x000000007464E000-memory.dmp

    Filesize

    6.9MB

    Download

  • memory/2808-1-0x0000000001080000-0x000000000113C000-memory.dmp

    Filesize

    752KB

    Download