Analysis

  • max time kernel
    114s
  • max time network
    121s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16-09-2024 14:43

General

  • Target

    TrojanDownloader.Win32.Berbew.exe

  • Size

    94KB

  • MD5

    ca0a8adb47972366efb75fda742d85e0

  • SHA1

    fce7efadfcd430690a751eb0b919d112143a541d

  • SHA256

    39c7d5451f62c483e10970dcdb57ec74db3ee0d8bd2baa7f4ea60e55afd152c6

  • SHA512

    2e6d06edd5fcf75b0bc370f4c2d09a5a63c3e33e89c39b45e8161f2915a1bd22be81abb1c9033558f3365dc6ea2a8f9dbabcf0da22ac47abd94a189d327f7661

  • SSDEEP

    1536:J7OGBym4dP6SgOj6VIpF1AYCajf7pid6sCDKWH8ee2gnxdRVkeyyVr3iwcH2ogHx:Rtsm4kuoIpYYbkCD3zIj3kremwc/gHx

Malware Config

Extracted

Family

berbew

C2

http://f/wcmd.htm

http://f/ppslog.php

http://f/piplog.php?%s:%i:%i:%s:%09u:%i:%02d:%02d:%02d

Signatures

  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 36 IoCs
  • Berbew

    Berbew is a backdoor written in C++.

  • Executes dropped EXE 18 IoCs
  • Drops file in System32 directory 54 IoCs
  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 57 IoCs
  • Suspicious use of WriteProcessMemory 54 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TrojanDownloader.Win32.Berbew.exe
    "C:\Users\Admin\AppData\Local\Temp\TrojanDownloader.Win32.Berbew.exe"
    1⤵
    • Adds autorun key to be loaded by Explorer.exe on startup
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Windows\SysWOW64\Kahinkaf.exe
      C:\Windows\system32\Kahinkaf.exe
      2⤵
      • Adds autorun key to be loaded by Explorer.exe on startup
      • Executes dropped EXE
      • Drops file in System32 directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:2912
      • C:\Windows\SysWOW64\Klmnkdal.exe
        C:\Windows\system32\Klmnkdal.exe
        3⤵
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Executes dropped EXE
        • Drops file in System32 directory
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of WriteProcessMemory
        PID:1656
        • C:\Windows\SysWOW64\Kajfdk32.exe
          C:\Windows\system32\Kajfdk32.exe
          4⤵
          • Adds autorun key to be loaded by Explorer.exe on startup
          • Executes dropped EXE
          • Drops file in System32 directory
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of WriteProcessMemory
          PID:4508
          • C:\Windows\SysWOW64\Khdoqefq.exe
            C:\Windows\system32\Khdoqefq.exe
            5⤵
            • Adds autorun key to be loaded by Explorer.exe on startup
            • Executes dropped EXE
            • Drops file in System32 directory
            • System Location Discovery: System Language Discovery
            • Modifies registry class
            • Suspicious use of WriteProcessMemory
            PID:4000
            • C:\Windows\SysWOW64\Kongmo32.exe
              C:\Windows\system32\Kongmo32.exe
              6⤵
              • Adds autorun key to be loaded by Explorer.exe on startup
              • Executes dropped EXE
              • Drops file in System32 directory
              • System Location Discovery: System Language Discovery
              • Modifies registry class
              • Suspicious use of WriteProcessMemory
              PID:1200
              • C:\Windows\SysWOW64\Kdkoef32.exe
                C:\Windows\system32\Kdkoef32.exe
                7⤵
                • Adds autorun key to be loaded by Explorer.exe on startup
                • Executes dropped EXE
                • Drops file in System32 directory
                • System Location Discovery: System Language Discovery
                • Modifies registry class
                • Suspicious use of WriteProcessMemory
                PID:2076
                • C:\Windows\SysWOW64\Kopcbo32.exe
                  C:\Windows\system32\Kopcbo32.exe
                  8⤵
                  • Adds autorun key to be loaded by Explorer.exe on startup
                  • Executes dropped EXE
                  • Drops file in System32 directory
                  • System Location Discovery: System Language Discovery
                  • Modifies registry class
                  • Suspicious use of WriteProcessMemory
                  PID:4480
                  • C:\Windows\SysWOW64\Kaopoj32.exe
                    C:\Windows\system32\Kaopoj32.exe
                    9⤵
                    • Adds autorun key to be loaded by Explorer.exe on startup
                    • Executes dropped EXE
                    • Drops file in System32 directory
                    • System Location Discovery: System Language Discovery
                    • Modifies registry class
                    • Suspicious use of WriteProcessMemory
                    PID:4536
                    • C:\Windows\SysWOW64\Kkgdhp32.exe
                      C:\Windows\system32\Kkgdhp32.exe
                      10⤵
                      • Adds autorun key to be loaded by Explorer.exe on startup
                      • Executes dropped EXE
                      • Drops file in System32 directory
                      • System Location Discovery: System Language Discovery
                      • Modifies registry class
                      • Suspicious use of WriteProcessMemory
                      PID:3340
                      • C:\Windows\SysWOW64\Kemhei32.exe
                        C:\Windows\system32\Kemhei32.exe
                        11⤵
                        • Adds autorun key to be loaded by Explorer.exe on startup
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • System Location Discovery: System Language Discovery
                        • Modifies registry class
                        • Suspicious use of WriteProcessMemory
                        PID:1664
                        • C:\Windows\SysWOW64\Loemnnhe.exe
                          C:\Windows\system32\Loemnnhe.exe
                          12⤵
                          • Adds autorun key to be loaded by Explorer.exe on startup
                          • Executes dropped EXE
                          • Drops file in System32 directory
                          • System Location Discovery: System Language Discovery
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:3548
                          • C:\Windows\SysWOW64\Lhmafcnf.exe
                            C:\Windows\system32\Lhmafcnf.exe
                            13⤵
                            • Adds autorun key to be loaded by Explorer.exe on startup
                            • Executes dropped EXE
                            • Drops file in System32 directory
                            • System Location Discovery: System Language Discovery
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:952
                            • C:\Windows\SysWOW64\Lklnconj.exe
                              C:\Windows\system32\Lklnconj.exe
                              14⤵
                              • Adds autorun key to be loaded by Explorer.exe on startup
                              • Executes dropped EXE
                              • Drops file in System32 directory
                              • System Location Discovery: System Language Discovery
                              • Modifies registry class
                              • Suspicious use of WriteProcessMemory
                              PID:4416
                              • C:\Windows\SysWOW64\Leabphmp.exe
                                C:\Windows\system32\Leabphmp.exe
                                15⤵
                                • Adds autorun key to be loaded by Explorer.exe on startup
                                • Executes dropped EXE
                                • Drops file in System32 directory
                                • System Location Discovery: System Language Discovery
                                • Modifies registry class
                                • Suspicious use of WriteProcessMemory
                                PID:2040
                                • C:\Windows\SysWOW64\Llkjmb32.exe
                                  C:\Windows\system32\Llkjmb32.exe
                                  16⤵
                                  • Adds autorun key to be loaded by Explorer.exe on startup
                                  • Executes dropped EXE
                                  • Drops file in System32 directory
                                  • System Location Discovery: System Language Discovery
                                  • Modifies registry class
                                  • Suspicious use of WriteProcessMemory
                                  PID:1940
                                  • C:\Windows\SysWOW64\Ledoegkm.exe
                                    C:\Windows\system32\Ledoegkm.exe
                                    17⤵
                                    • Adds autorun key to be loaded by Explorer.exe on startup
                                    • Executes dropped EXE
                                    • Drops file in System32 directory
                                    • System Location Discovery: System Language Discovery
                                    • Modifies registry class
                                    • Suspicious use of WriteProcessMemory
                                    PID:2260
                                    • C:\Windows\SysWOW64\Lkqgno32.exe
                                      C:\Windows\system32\Lkqgno32.exe
                                      18⤵
                                      • Adds autorun key to be loaded by Explorer.exe on startup
                                      • Executes dropped EXE
                                      • Drops file in System32 directory
                                      • System Location Discovery: System Language Discovery
                                      • Modifies registry class
                                      • Suspicious use of WriteProcessMemory
                                      PID:1828
                                      • C:\Windows\SysWOW64\Ldikgdpe.exe
                                        C:\Windows\system32\Ldikgdpe.exe
                                        19⤵
                                        • Executes dropped EXE
                                        • System Location Discovery: System Language Discovery
                                        PID:3644
                                        • C:\Windows\SysWOW64\WerFault.exe
                                          C:\Windows\SysWOW64\WerFault.exe -u -p 3644 -s 412
                                          20⤵
                                          • Program crash
                                          PID:1680
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3644 -ip 3644
    1⤵
      PID:4024
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4060,i,9445584274764997943,12714240264001792460,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8
      1⤵
        PID:3956

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Windows\SysWOW64\Kahinkaf.exe

        Filesize

        94KB

        MD5

        7cb7efad322363d4617639d4ebc2b78e

        SHA1

        5ec50d026dc05d5d544bd12f8cccd0caffba79f1

        SHA256

        2414b2602ccea6b8a8a6e272ea18cd9c0f89f30c663387d7184012beb733e88c

        SHA512

        0035e32f4df157e57d838a29d3f76713e5114887d69dd94c11f5eb2d4fa8fb0ee52f893d70bdbfcc47ac5fafaf897891ebee79aba1ba8db395de629e9906266b

      • C:\Windows\SysWOW64\Kajfdk32.exe

        Filesize

        94KB

        MD5

        1d9a4465f6f93cbce336c5f479706c26

        SHA1

        e6631270e00641fad43b7260edab99af639986dc

        SHA256

        8e78237850481273da5376cef5b0516b88f96f57aab65d7ccbc58d7996e2b37e

        SHA512

        d409b15c1f727ccd90e9373b6e293324a444bb68eb6d8a0f27e89b4bd1766189db3a2ca911daca3b7ddb6f54f7738a94462af31d94081a18f3f43e8e6cb8598e

      • C:\Windows\SysWOW64\Kaopoj32.exe

        Filesize

        94KB

        MD5

        b20f2559e5eb781a6f496b49969ed66a

        SHA1

        830fe99fcd3103b32c5e3e1ca7bb0cbdc8a3e3d1

        SHA256

        6f91adbb227adb22eb0d989c447f559a91692a087da01256e08206d79c7749f5

        SHA512

        c2c95878a5cafa81ca189bbed0a4984ae9c734faebe1687b2fcdc7f413cea74a257055bb5415d064cbef1ad9a054f2498c5e8066b75f535a8cad69c887ef64ab

      • C:\Windows\SysWOW64\Kdkoef32.exe

        Filesize

        94KB

        MD5

        ca6e506f56f2fc831a16f9abd4712088

        SHA1

        81676ac3b15e9a193cc175ca64a2196d097a21ec

        SHA256

        1d411d05b7ffda222f5480a5ef5cde7d4241e97633cbd23c627d710280a90f7e

        SHA512

        f1187a0f76aab7fe3ad2898e33595893de7ca875b395b2653280b4a8a8419f7ca30d4976078858da063aaf7aa7b3ff75e26760d6d8c7f3103f1413912f3ccdce

      • C:\Windows\SysWOW64\Kemhei32.exe

        Filesize

        94KB

        MD5

        39b70ed26db5a0709342a0d5f3373f39

        SHA1

        4163cbff2eaea45f6ea3f7b7e0e0cf4ee3d1d933

        SHA256

        6c1ef80aa318f6a948bf0ae299c481be3491ad90fd8d437c4d1d530c0b37f816

        SHA512

        de3ec6d80618b19d97a8c38ce844e57f92fca03b9d3f1c90ec31e848a7198721e4eaf695c36231f270d900ae98591552f76c669b011bb358404b19b3005178e5

      • C:\Windows\SysWOW64\Khdoqefq.exe

        Filesize

        94KB

        MD5

        3a847c56bb105de278b157b8f8166a24

        SHA1

        406f825fd313a7e89773a424992fbe5c8d2c3d41

        SHA256

        25ef6ccd1daa092445c230bbe74fd5422ef10a678edfa733cc9004d80d6fee58

        SHA512

        583bf888622ed1eb35cc6f6fcc6602af7fade0bb56aba433d9f6e1c026b03e6a4fa418c8bf5fbfd1edde184fda729d2cbc4ab8fe5859f1e289f40feba405d56d

      • C:\Windows\SysWOW64\Kkgdhp32.exe

        Filesize

        94KB

        MD5

        f444d29d1ed51c948570eeba70b16ec4

        SHA1

        e27642d1053cc8a93ce42a3ead481b09a0037c03

        SHA256

        22db951231635268657ff38dcd7ec107ceae365abc1ac274b6d8426802cc5016

        SHA512

        cbcd667e23e6b7b98b5fc349ac0c7f01e074b76170fdb2b5b4914c5fc3fe97fb78fcc1bb94dbff87e0ce9179a98216efb5db912e59ac1e55add65580ceb36994

      • C:\Windows\SysWOW64\Klmnkdal.exe

        Filesize

        94KB

        MD5

        aadae8d3f97ea81a3589d7b3973bff02

        SHA1

        5841a89dd77b00fe158a9d8ec94e77ea8d7940f3

        SHA256

        2520d876a2ec1fc8b9953c8c34e6cc940af13b6f8b51da74a2982ba09900bca6

        SHA512

        8340e13ea99072277f1a921e5a7b7d42314c1cfd4991c7bfc160cbea76b4718895d2a7ff4608f5547d4bea0364c4142d10574bb8fd0d97aefd735d9019fddf18

      • C:\Windows\SysWOW64\Kongmo32.exe

        Filesize

        94KB

        MD5

        10ac16aa532949a26c5a71cfeb0d7a54

        SHA1

        6702c1f8e8ac9b97b0794434bc53f30df19f28f0

        SHA256

        f551f95e544e92b3020160dfbc481a36fb4c336f5e88b2419345e5d19f7e6afb

        SHA512

        6cb47d0a44fdb8247ef2bba1a4db1bc7019bc68534dd8cf2fac55659ad42238898855e6596c58cba3381fd313788e0c64791c5309dcf8c340b91da19565a6544

      • C:\Windows\SysWOW64\Kopcbo32.exe

        Filesize

        94KB

        MD5

        9851e74497bc71b862e6c7c2e3dba342

        SHA1

        b4a2dc899c89ded8bfad56e298511de580038ad1

        SHA256

        d004da38281f15d2e1accd6a72c93d7f3ced617ff5f9bfcb3c9e0f0fbf808ed4

        SHA512

        6a197e336288314da2b333f8c347775ade74efe3a012ed36f67e07d42ce77f13fb14a23f90f44e9700caa550746697c53a604bae0c96750ba21a5fecf20a754c

      • C:\Windows\SysWOW64\Ldikgdpe.exe

        Filesize

        94KB

        MD5

        c94c550204e35bda42b73eda47fc8ee7

        SHA1

        5c3086789baa31c58f8be3703b5fda66d7ec8681

        SHA256

        9679f2bd5c4fd2e9856cdfe79542f2375e4c5ee525bc30916bbd6ea67af6c59b

        SHA512

        9af693ecf8c9fd8808962d38c54d3222305678e3257e6a35043479e4a6597a957864900a64411da22caaafa95e80feaff0903812885c6f0a3522837f6917afb5

      • C:\Windows\SysWOW64\Leabphmp.exe

        Filesize

        94KB

        MD5

        6fed1f739ce0ed066857c6a9081ee909

        SHA1

        11b7e47ff44eaffe46575f837b0a3d91d6f9bc0b

        SHA256

        ad659f72e78c9ef7a9abb4c3b03ce07129a1fb11d33ca8fb61901bd5851fd5e0

        SHA512

        58126b513d6780acec4b21d792cb192387e5771eb6b649a873f2eee084d02ec36496998bfbec44dce821129c14581673568068115118c697622225acfb0d58a7

      • C:\Windows\SysWOW64\Ledoegkm.exe

        Filesize

        94KB

        MD5

        f3eeef0bd0d2d1c9d9e98874f681073b

        SHA1

        4c7603afa69312ad0918b6c0ab3e283f84002a24

        SHA256

        d339b0894f87bb6cf61f81ff43fc3364643fadc101c94547bcf461876aa03f9f

        SHA512

        c494021650f896c9554ccd1ca0fceefc51a2f59ac4355973422ca8134b483a8d331828597a9f820dcbb5a9c1869b337547c22ff909ddbb970bb9633fd57d7f2b

      • C:\Windows\SysWOW64\Lhmafcnf.exe

        Filesize

        94KB

        MD5

        26498b75c737a5a8f30dc8004115e680

        SHA1

        ea60469f7fa54fc4fc828cad209f193ea1f1789a

        SHA256

        7c0a439d157c9dec159a4cfa84150ce692401dd69b3da6cbbe8721de8b5c7416

        SHA512

        b6dfae1889e775294798297a55e7bd3e77fb88512f87bb248692d802a0c08b3ec41d52c4f8025bfe57eee895228ebfe9ba6bd232b341c3eaf69212166c7d00a9

      • C:\Windows\SysWOW64\Lklnconj.exe

        Filesize

        94KB

        MD5

        928eb1a1307798245de855cb1ea819a8

        SHA1

        8da76233b0b1401652e70250414c7fe25d47336d

        SHA256

        fba92131c972b59329d6a97c712ce99dd3d9b985d8ab61b242563605e3ff3997

        SHA512

        e0ea3e7497553cc1db9cae87f84b1704bcc3cd3eedc2ae3478e3967c00e9fd954c2cac409094cdc79a565880af6ab04c04505627bb0fe8e848cc1bb199dfd0f2

      • C:\Windows\SysWOW64\Lkqgno32.exe

        Filesize

        94KB

        MD5

        05060fc3529f6b8c9fca93a9aa68be18

        SHA1

        c8d35b583ea0992e2a470b924ab74482778f29e2

        SHA256

        d3f1df82497fad11bc6a83b2e6e019af6cabf75767b5dbd8200e95d96788da2d

        SHA512

        0079490f750f303c4186b0ed8e58e6a9a640a5a81e7f3726d00929f083bbb1fa0b9a5923b466fd7a2162957f6e76574705b64a78dff831ca3e128cec1b8dccc4

      • C:\Windows\SysWOW64\Llkjmb32.exe

        Filesize

        94KB

        MD5

        8b4c2f76af5aa204c22e6229e8fe1fd0

        SHA1

        bfe83c76502866543865b1754afb57382ec55900

        SHA256

        471294853d8d07dbd093e88b46e11b1953f2ccf8239cf184270f02d057bc7e07

        SHA512

        3e392937d3e57791077d3405a6ffb7606e213e1117eda064d5b87e613fa74dbd1b6a56debc6b72c23339b5b4b7b411238942fc82404fef5fee57487245225b8b

      • C:\Windows\SysWOW64\Loemnnhe.exe

        Filesize

        94KB

        MD5

        1c539a295f91ab91a1c4f930b83539df

        SHA1

        e578e437056cacbee91f3b6250e594afce556b94

        SHA256

        01424f351a6e713b7dfa39dec6b44474db357ee04ebf56dd6e2a3211e5c3e3ea

        SHA512

        213c91a67ff92eb48d193f21e78e6bd672904e7813387c6c68b4accb84f5fa31c96ea690179663715caa7ffb1f0fae8ac3508b7110668bf3f6514876c275d1a6

      • C:\Windows\SysWOW64\Loemnnhe.exe

        Filesize

        94KB

        MD5

        3956c12aaccc1d1f85dc0cf273210430

        SHA1

        95f748ea650a583315602dcc7fc362a90dd3f8f8

        SHA256

        a54374002a452e14c829dfecae4108e71ca10ab50c69fce5bd74412d5e7458e0

        SHA512

        019f5250437a35976f32504d448f54599421277683504f4ad4bfe27cd030f746cf93e68bda16a8c9744254bae05244854c6407761955f65b7573eb808e9b5ffe

      • C:\Windows\SysWOW64\Mhfdfbqe.dll

        Filesize

        7KB

        MD5

        307d883845abb7666927e505c73239ea

        SHA1

        16b7ebafc0172b7e9992beb227f44560d48c4f44

        SHA256

        c9e2c96b8ea7db880970059a672bda0fea97c2423d6777d2d143c45df9318d13

        SHA512

        be8a835967791a21bdc6570cbdd75afaf96b225b5b0eb47b1114bcd58bd6e3ae2b8b3511a309d44d66d0656198a93ccd77a63a7f3a488e0d9a110af5b669946a

      • memory/952-151-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/952-95-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1200-158-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1200-39-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1656-161-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1656-16-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1664-79-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1664-153-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1828-146-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1828-135-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1844-163-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1844-0-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1940-148-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/1940-119-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/2040-111-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/2040-149-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/2076-157-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/2076-48-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/2260-127-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/2260-147-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/2912-8-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/2912-162-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/3340-154-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/3340-71-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/3548-87-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/3548-152-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/3644-145-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/3644-143-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/4000-159-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/4000-32-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/4416-104-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/4416-150-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/4480-156-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/4480-56-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/4508-23-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/4508-160-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/4536-63-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB

      • memory/4536-155-0x0000000000400000-0x000000000043F000-memory.dmp

        Filesize

        252KB