Analysis
-
max time kernel
121s -
max time network
119s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
26-04-2024 23:58
Static task
static1
Behavioral task
behavioral1
Sample
Seroxen.exe
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Seroxen.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Seroxen.exe
Resource
win11-20240419-en
General
-
Target
Seroxen.exe
-
Size
12KB
-
MD5
8208ea3955533b799b0f5f65db02df8a
-
SHA1
8829745dd294bb94d1dc39266cb2b8c2457b00cd
-
SHA256
0663f1114eca93d267e0ae9ddbaacf05974d77c0fa95efdf22f23ecbdf8e38cb
-
SHA512
f9d17761a044ec89490c7727a4cd365f950dd4e5f56762363ea8441fed2a6552036aafc8804fdddf87488148d2e94052e8f94c11dcc36e77d8d047baaf97448a
-
SSDEEP
192:+3s2rvMWWwghZv1Bsl0csO9qqjKw65dKUmP+eBQ8JG0x/kPo:as27M/zhZNyWjO9H65dDmPVQKdkw
Malware Config
Extracted
gozi
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Seroxen.exewscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation Seroxen.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation wscript.exe -
Executes dropped EXE 1 IoCs
Processes:
lboc0ncv.exepid process 3120 lboc0ncv.exe -
Loads dropped DLL 1 IoCs
Processes:
Seroxen.exepid process 3152 Seroxen.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs
Processes:
flow ioc 59 discord.com 14 raw.githubusercontent.com 15 raw.githubusercontent.com 47 discord.com 48 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 55 checkip.amazonaws.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry class 7 IoCs
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\ms-settings\shell\open\command reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\ms-settings\shell\open\command\DelegateExecute = "0" reg.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\ms-settings\shell\open\command reg.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\ms-settings reg.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\ms-settings\shell reg.exe Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\ms-settings\shell\open reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\ms-settings\shell\open\command\ = "wscript.exe C:\\Users\\Admin\\AppData\\Local\\Temp\\applejack1448147.vbs" reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
Seroxen.exelboc0ncv.exepid process 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3120 lboc0ncv.exe 3120 lboc0ncv.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe 3152 Seroxen.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Seroxen.exelboc0ncv.exedescription pid process Token: SeDebugPrivilege 3152 Seroxen.exe Token: SeDebugPrivilege 3120 lboc0ncv.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Seroxen.exepid process 3152 Seroxen.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
Seroxen.execmd.exeComputerDefaults.execmd.exewscript.exelboc0ncv.exedescription pid process target process PID 3152 wrote to memory of 4764 3152 Seroxen.exe reg.exe PID 3152 wrote to memory of 4764 3152 Seroxen.exe reg.exe PID 3152 wrote to memory of 4764 3152 Seroxen.exe reg.exe PID 3152 wrote to memory of 4956 3152 Seroxen.exe reg.exe PID 3152 wrote to memory of 4956 3152 Seroxen.exe reg.exe PID 3152 wrote to memory of 4956 3152 Seroxen.exe reg.exe PID 3152 wrote to memory of 560 3152 Seroxen.exe cmd.exe PID 3152 wrote to memory of 560 3152 Seroxen.exe cmd.exe PID 3152 wrote to memory of 560 3152 Seroxen.exe cmd.exe PID 560 wrote to memory of 2940 560 cmd.exe ComputerDefaults.exe PID 560 wrote to memory of 2940 560 cmd.exe ComputerDefaults.exe PID 560 wrote to memory of 2940 560 cmd.exe ComputerDefaults.exe PID 2940 wrote to memory of 1484 2940 ComputerDefaults.exe wscript.exe PID 2940 wrote to memory of 1484 2940 ComputerDefaults.exe wscript.exe PID 2940 wrote to memory of 1484 2940 ComputerDefaults.exe wscript.exe PID 3152 wrote to memory of 1212 3152 Seroxen.exe cmd.exe PID 3152 wrote to memory of 1212 3152 Seroxen.exe cmd.exe PID 3152 wrote to memory of 1212 3152 Seroxen.exe cmd.exe PID 1212 wrote to memory of 2284 1212 cmd.exe schtasks.exe PID 1212 wrote to memory of 2284 1212 cmd.exe schtasks.exe PID 1212 wrote to memory of 2284 1212 cmd.exe schtasks.exe PID 1484 wrote to memory of 1448 1484 wscript.exe cmd.exe PID 1484 wrote to memory of 1448 1484 wscript.exe cmd.exe PID 1484 wrote to memory of 1448 1484 wscript.exe cmd.exe PID 3152 wrote to memory of 3120 3152 Seroxen.exe lboc0ncv.exe PID 3152 wrote to memory of 3120 3152 Seroxen.exe lboc0ncv.exe PID 3120 wrote to memory of 3300 3120 lboc0ncv.exe Explorer.EXE PID 3120 wrote to memory of 3300 3120 lboc0ncv.exe Explorer.EXE PID 3120 wrote to memory of 3300 3120 lboc0ncv.exe Explorer.EXE PID 3120 wrote to memory of 3300 3120 lboc0ncv.exe Explorer.EXE PID 3120 wrote to memory of 3300 3120 lboc0ncv.exe Explorer.EXE PID 3120 wrote to memory of 3300 3120 lboc0ncv.exe Explorer.EXE PID 3120 wrote to memory of 3300 3120 lboc0ncv.exe Explorer.EXE PID 3120 wrote to memory of 3300 3120 lboc0ncv.exe Explorer.EXE PID 3120 wrote to memory of 3300 3120 lboc0ncv.exe Explorer.EXE PID 3120 wrote to memory of 3300 3120 lboc0ncv.exe Explorer.EXE PID 3120 wrote to memory of 3300 3120 lboc0ncv.exe Explorer.EXE PID 3120 wrote to memory of 3300 3120 lboc0ncv.exe Explorer.EXE PID 3120 wrote to memory of 3300 3120 lboc0ncv.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\Seroxen.exe"C:\Users\Admin\AppData\Local\Temp\Seroxen.exe"2⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /d "wscript.exe C:\Users\Admin\AppData\Local\Temp\applejack1448147.vbs" /f3⤵
- Modifies registry class
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" add "HKCU\Software\Classes\ms-settings\shell\open\command" /v DelegateExecute /d "0" /f3⤵
- Modifies registry class
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C computerdefaults.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ComputerDefaults.execomputerdefaults.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\wscript.exe"wscript.exe" C:\Users\Admin\AppData\Local\Temp\applejack1448147.vbs5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C del C:\Windows\System32\drivers\etc\hosts6⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /Create /SC ONLOGON /TN FoxitReaderUpdater_FGHgbhnJDeyD1gGgf050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\FGHgbhnJDeyD1gGgf050MX.exe" /RL HIGHEST /IT3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Create /SC ONLOGON /TN FoxitReaderUpdater_FGHgbhnJDeyD1gGgf050MX /TR "C:\Users\Admin\AppData\Local\Microsoft\InputPersonalization\FGHgbhnJDeyD1gGgf050MX.exe" /RL HIGHEST /IT4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\lboc0ncv.exe"C:\Users\Admin\AppData\Local\Temp\lboc0ncv.exe" explorer.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2392 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\5e1a1f161a4f455497770854e5373ed6Filesize
36KB
MD55deaa13040e111ddb1b0def1692e9681
SHA162d2ec1f82cd6a42a37d099945679a2a4eb8f96b
SHA256cf87b8a2ef7c58b473051118b1a1deb5d7e21f9bf300e0d20c1992b6ebebcbb5
SHA5128c45f2c3854bd6db1deaba2c5f87d69b484007d2922cd900f5fd79488fddcad820e28a9a2d33cd96be1b0ed144175f209ae0716549ab60fa35a8da0dcd945b06
-
C:\Users\Admin\AppData\Local\Temp\62c18dad0c0f4d22b13b0843049c6c04Filesize
46KB
MD502d2c46697e3714e49f46b680b9a6b83
SHA184f98b56d49f01e9b6b76a4e21accf64fd319140
SHA256522cad95d3fa6ebb3274709b8d09bbb1ca37389d0a924cd29e934a75aa04c6c9
SHA51260348a145bfc71b1e07cb35fa79ab5ff472a3d0a557741ea2d39b3772bc395b86e261bd616f65307ae0d997294e49b5548d32f11e86ef3e2704959ca63da8aac
-
C:\Users\Admin\AppData\Local\Temp\Costura\40BD99E3E2E3C109881E4ECA2DEDC617\32\sqlite.interop.dllFilesize
1.4MB
MD56f2fdecc48e7d72ca1eb7f17a97e59ad
SHA1fcbc8c4403e5c8194ee69158d7e70ee7dbd4c056
SHA25670e48ef5c14766f3601c97451b47859fddcbe7f237e1c5200cea8e7a7609d809
SHA512fea98a3d6fff1497551dc6583dd92798dcac764070a350fd381e856105a6411c94effd4b189b7a32608ff610422b8dbd6d93393c5da99ee66d4569d45191dc8b
-
C:\Users\Admin\AppData\Local\Temp\applejack1448147.vbsFilesize
171B
MD5a34267102c21aff46aecc85598924544
SHA177268af47c6a4b9c6be7f7487b2c9b233d49d435
SHA256eba7ab5c248e46dbe70470b41ebf25a378b4eff9ce632adff927ac1f95583d44
SHA5125d320312b93b46c9051a20c82d6405a3f2c78b23adb3ab3e71aad854b65b500937de7ca2986cf79967386d689beecccf676d89afde8ecc5d5ad0cb4ae2bf38a3
-
C:\Users\Admin\AppData\Local\Temp\ef6697d47e5541ab97e17c9cf4119885Filesize
128KB
MD594fbd97056c80fa403b2c5229fde6796
SHA1cb9016e8860e3af8d8c97815a71be94d33dee04d
SHA2564cf5e14d554d9f59f96bfe5bf954765de5c5c47f1ca7782a7bf929edaa5ba8af
SHA512ade8641e3156e7750d6770e07e49801e6bcd903457461f7a85acb58da25356c90be68f20372a0e110cdfe8679c99881eeeb9c1d0acfea235b5f872df5519e49e
-
C:\Users\Admin\AppData\Local\Temp\lboc0ncv.exeFilesize
124KB
MD5e898826598a138f86f2aa80c0830707a
SHA11e912a5671f7786cc077f83146a0484e5a78729c
SHA256df443ccf551470b3f9f7d92faf51b3b85ae206dd08da3b6390ce9a6039b7253a
SHA5126827068b8580822ded1fb8447bdb038d0e00633f5ef7f480a8cdeaab6928ac23022a0b7a925058e0926ce9b41a6c8c22a5692e074621b2fccdb7edd29a0d4cfb
-
C:\Users\Admin\AppData\Roaming\Gongle\aHWP8LMSVE\LOGFilesize
331B
MD54d23c18ccd937bb6bf0f866db6f80d07
SHA1bca94906c9e1c68ba7d765cf04b8a60147e77b37
SHA256d77012c3efa59dbd5db7444f1db7c0c42fdab86c0f2eee5aabe17fbfbe81f0ab
SHA512ecd868d5d40f1a0588a3664bf60dcd2b15c5ba2368a0e98e610748abd1b2175c978a3d59cce86a8575797a2d117c37a25ab2303ea7a45f82acd647173b407416
-
C:\Users\Admin\AppData\Roaming\Gongle\aHWP8LMSVE\LOG.oldFilesize
331B
MD53c1fc56d34b7f53cadd25894e47ab9e1
SHA1f3c71b4394be75915fc5fe11efc0c0f1e42fc32c
SHA256e03f406f35648ff3e39d4746d2dd47e4d15891b42dcd76c71e9aa8a94b268171
SHA512f22dbec590cf4456b1756eccc56407447f053a4d3bac5e16023602befa2f9d3ced6be6543d84718cc401184382013ebf0e1fd65aad3203e480e482590212d628
-
C:\Users\Admin\AppData\Roaming\Gongle\aKYSMJ7ZH7\4s2odj76.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqliteFilesize
48KB
MD525ff28418b95c9c269e808afc541243a
SHA1fab49d187fc6a3cad1c5f8a104c85aeeb99ea739
SHA2564ac1a451261fefeb103319c2ab8a2c6cc5939cf36e5e4ee69b17fa8433874f69
SHA512a626c22451c06fda6df1e50bacbb4adaced23f34e1a849b5424eeaec7045fdd64def1e2707f15e75094ec92b52bdbb9ebc160eaf3a4551fcfc60fc22bef24bf1
-
C:\Users\Admin\AppData\Roaming\Gongle\aXCION7PYV\CURRENTFilesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Roaming\Gongle\aXCION7PYV\LOGFilesize
329B
MD534269408a971d7accecb1d5d381ec3c8
SHA10597674a6c40b07b473fb59220dcd5c1245177d9
SHA25644a5c9eae54b0724e3cf515ce1e125fe7da89f6030c54fe57a579d3aae474649
SHA51245768e1ea2210070effa1c7662bcaf2b9442b2a44cbd4c94b1662973ee80ce306fb6c86f909a88d9854875cb041c25ab809e43ca2bca981087b5fa01ad9cd450
-
C:\Users\Admin\AppData\Roaming\Gongle\aXCION7PYV\LOG.oldFilesize
289B
MD5d849b77287da756d1dbc40976cc66530
SHA1eb21969f8d6f9abcc8a246efc339887f9dba8c69
SHA2564e70e1124b3888853a84aa5b0f28d2c744529f388ef46a79c9518b5c85393eaa
SHA512a75602ba24c002fc45ad3dd53dfdc280a5de93f77119206f06938dd0bb868bce7271f14dbed6f86c67f3f694f67dd0a99ad9e98dacd307298ca2004c096d3e25
-
C:\Users\Admin\AppData\Roaming\Gongle\aXCION7PYV\MANIFEST-000001Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
memory/3152-42-0x0000000009C80000-0x0000000009C8A000-memory.dmpFilesize
40KB
-
memory/3152-5-0x00000000053D0000-0x0000000005462000-memory.dmpFilesize
584KB
-
memory/3152-1-0x0000000000450000-0x000000000045C000-memory.dmpFilesize
48KB
-
memory/3152-198-0x000000000AF00000-0x000000000AF0A000-memory.dmpFilesize
40KB
-
memory/3152-2-0x00000000052F0000-0x000000000530A000-memory.dmpFilesize
104KB
-
memory/3152-3-0x00000000054B0000-0x00000000054C0000-memory.dmpFilesize
64KB
-
memory/3152-39-0x0000000006990000-0x00000000069A2000-memory.dmpFilesize
72KB
-
memory/3152-40-0x0000000008F90000-0x0000000008FF6000-memory.dmpFilesize
408KB
-
memory/3152-41-0x0000000007CD0000-0x0000000007CDA000-memory.dmpFilesize
40KB
-
memory/3152-0-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/3152-44-0x0000000009D00000-0x0000000009D08000-memory.dmpFilesize
32KB
-
memory/3152-43-0x0000000007CC0000-0x0000000007CCC000-memory.dmpFilesize
48KB
-
memory/3152-13-0x0000000013390000-0x0000000014032000-memory.dmpFilesize
12.6MB
-
memory/3152-12-0x00000000054B0000-0x00000000054C0000-memory.dmpFilesize
64KB
-
memory/3152-11-0x0000000074F00000-0x00000000756B0000-memory.dmpFilesize
7.7MB
-
memory/3152-10-0x000000000B1F0000-0x000000000BDF0000-memory.dmpFilesize
12.0MB
-
memory/3152-6-0x0000000005A70000-0x0000000006014000-memory.dmpFilesize
5.6MB
-
memory/3152-184-0x000000000AE60000-0x000000000AE81000-memory.dmpFilesize
132KB
-
memory/3152-4-0x00000000052E0000-0x00000000052EA000-memory.dmpFilesize
40KB
-
memory/3152-172-0x0000000006C70000-0x0000000006D22000-memory.dmpFilesize
712KB
-
memory/3152-173-0x0000000006D80000-0x0000000006DA2000-memory.dmpFilesize
136KB
-
memory/3152-174-0x000000000ACC0000-0x000000000AD36000-memory.dmpFilesize
472KB
-
memory/3152-175-0x0000000009980000-0x000000000999E000-memory.dmpFilesize
120KB
-
memory/3152-176-0x000000000AD40000-0x000000000AD90000-memory.dmpFilesize
320KB
-
memory/3152-177-0x000000000AD90000-0x000000000ADFA000-memory.dmpFilesize
424KB
-
memory/3152-178-0x000000000DDF0000-0x000000000E144000-memory.dmpFilesize
3.3MB
-
memory/3152-179-0x000000000AE00000-0x000000000AE4C000-memory.dmpFilesize
304KB
-
memory/3152-183-0x000000000AEA0000-0x000000000AEDC000-memory.dmpFilesize
240KB
-
memory/3300-29-0x0000000002BA0000-0x0000000002BA1000-memory.dmpFilesize
4KB
-
memory/3300-34-0x0000000002880000-0x0000000002888000-memory.dmpFilesize
32KB
-
memory/3300-32-0x0000000002880000-0x0000000002888000-memory.dmpFilesize
32KB
-
memory/3300-30-0x0000000002880000-0x0000000002888000-memory.dmpFilesize
32KB
-
memory/3300-28-0x0000000002880000-0x0000000002888000-memory.dmpFilesize
32KB