Analysis
-
max time kernel
83s -
max time network
85s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-11-2020 22:52
Static task
static1
Behavioral task
behavioral1
Sample
3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe
Resource
win7v20201028
General
-
Target
3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe
-
Size
368KB
-
MD5
1d2542d9aebf664ac77f2b6e09219303
-
SHA1
1c89ae0e5dfb5eac8d06c4feabfaf714e6877b72
-
SHA256
3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9
-
SHA512
0a8dd1f27abc9993d4d338a0305d219641d2d0204c4c40ef36cd1a2da34c4ec5c271f929dd9dab0475a004d28e5e26c7689efd5265cf570d4c387f55f4766bd1
Malware Config
Extracted
trickbot
1000213
mon1
138.34.32.218:443
86.61.177.139:443
188.124.167.132:449
93.109.242.134:443
62.31.150.202:443
158.58.131.54:443
36.74.100.211:449
66.229.97.133:443
200.111.167.227:449
109.86.227.152:443
85.172.38.59:449
67.162.236.158:443
66.232.212.59:443
80.53.57.146:443
182.253.210.130:449
155.133.31.21:449
176.222.255.2:443
209.121.142.202:449
138.34.32.74:443
209.121.142.214:449
144.48.51.8:443
199.250.230.169:443
92.53.66.78:443
195.54.163.93:443
185.159.129.78:443
185.174.172.249:443
109.234.37.52:443
37.46.135.218:443
94.103.82.239:443
-
autorunControl:GetSystemInfoName:systeminfoName:injectDll
Signatures
-
Trickbot x86 loader 3 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/1120-0-0x0000000000400000-0x000000000043D000-memory.dmp trickbot_loader32 behavioral1/memory/1120-1-0x0000000000401000-mapping.dmp trickbot_loader32 behavioral1/memory/520-57-0x0000000000401000-mapping.dmp trickbot_loader32 -
Executes dropped EXE 2 IoCs
Processes:
3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exepid process 1684 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe -
Stops running service(s) 3 TTPs
-
Loads dropped DLL 1 IoCs
Processes:
3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exepid process 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exedescription pid process target process PID 364 set thread context of 1120 364 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe PID 1684 set thread context of 520 1684 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe -
Launches sc.exe
Sc.exe is a Windows utlilty to control services on the system.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exepowershell.exepid process 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe 400 powershell.exe 400 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 400 powershell.exe -
Suspicious use of WriteProcessMemory 718 IoCs
Processes:
3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.execmd.execmd.execmd.exe3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exedescription pid process target process PID 364 wrote to memory of 1120 364 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe PID 364 wrote to memory of 1120 364 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe PID 364 wrote to memory of 1120 364 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe PID 364 wrote to memory of 1120 364 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe PID 364 wrote to memory of 1120 364 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe PID 364 wrote to memory of 1120 364 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe PID 364 wrote to memory of 1120 364 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe PID 364 wrote to memory of 1120 364 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe PID 1120 wrote to memory of 816 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe cmd.exe PID 1120 wrote to memory of 816 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe cmd.exe PID 1120 wrote to memory of 816 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe cmd.exe PID 1120 wrote to memory of 816 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe cmd.exe PID 1120 wrote to memory of 1352 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe cmd.exe PID 1120 wrote to memory of 1352 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe cmd.exe PID 1120 wrote to memory of 1352 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe cmd.exe PID 1120 wrote to memory of 1352 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe cmd.exe PID 1120 wrote to memory of 556 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe cmd.exe PID 1120 wrote to memory of 556 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe cmd.exe PID 1120 wrote to memory of 556 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe cmd.exe PID 1120 wrote to memory of 556 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe cmd.exe PID 1120 wrote to memory of 1684 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe PID 1120 wrote to memory of 1684 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe PID 1120 wrote to memory of 1684 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe PID 1120 wrote to memory of 1684 1120 3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe PID 816 wrote to memory of 1532 816 cmd.exe sc.exe PID 816 wrote to memory of 1532 816 cmd.exe sc.exe PID 816 wrote to memory of 1532 816 cmd.exe sc.exe PID 816 wrote to memory of 1532 816 cmd.exe sc.exe PID 1352 wrote to memory of 1640 1352 cmd.exe sc.exe PID 1352 wrote to memory of 1640 1352 cmd.exe sc.exe PID 1352 wrote to memory of 1640 1352 cmd.exe sc.exe PID 1352 wrote to memory of 1640 1352 cmd.exe sc.exe PID 556 wrote to memory of 400 556 cmd.exe powershell.exe PID 556 wrote to memory of 400 556 cmd.exe powershell.exe PID 556 wrote to memory of 400 556 cmd.exe powershell.exe PID 556 wrote to memory of 400 556 cmd.exe powershell.exe PID 1684 wrote to memory of 520 1684 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe PID 1684 wrote to memory of 520 1684 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe PID 1684 wrote to memory of 520 1684 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe PID 1684 wrote to memory of 520 1684 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe PID 1684 wrote to memory of 520 1684 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe PID 1684 wrote to memory of 520 1684 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe PID 1684 wrote to memory of 520 1684 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe PID 1684 wrote to memory of 520 1684 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe PID 520 wrote to memory of 832 520 3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe"C:\Users\Admin\AppData\Local\Temp\3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe"C:\Users\Admin\AppData\Local\Temp\3d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend4⤵
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc delete WinDefend4⤵
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true4⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\netlibs\3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exeC:\Users\Admin\AppData\Roaming\netlibs\3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\netlibs\3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe"C:\Users\Admin\AppData\Roaming\netlibs\3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\netlibs\3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exeMD5
1d2542d9aebf664ac77f2b6e09219303
SHA11c89ae0e5dfb5eac8d06c4feabfaf714e6877b72
SHA2563d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9
SHA5120a8dd1f27abc9993d4d338a0305d219641d2d0204c4c40ef36cd1a2da34c4ec5c271f929dd9dab0475a004d28e5e26c7689efd5265cf570d4c387f55f4766bd1
-
C:\Users\Admin\AppData\Roaming\netlibs\3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exeMD5
1d2542d9aebf664ac77f2b6e09219303
SHA11c89ae0e5dfb5eac8d06c4feabfaf714e6877b72
SHA2563d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9
SHA5120a8dd1f27abc9993d4d338a0305d219641d2d0204c4c40ef36cd1a2da34c4ec5c271f929dd9dab0475a004d28e5e26c7689efd5265cf570d4c387f55f4766bd1
-
\Users\Admin\AppData\Roaming\netlibs\3d27dc62c623f01c7f03790e9b487bc03ff093d1c283ff134e9ae43d606ad9c9.exeMD5
1d2542d9aebf664ac77f2b6e09219303
SHA11c89ae0e5dfb5eac8d06c4feabfaf714e6877b72
SHA2563d26dc52c523f01c6f03680e9b476bc03ff093d1c273ff134e8ae43d505ad9c9
SHA5120a8dd1f27abc9993d4d338a0305d219641d2d0204c4c40ef36cd1a2da34c4ec5c271f929dd9dab0475a004d28e5e26c7689efd5265cf570d4c387f55f4766bd1
-
memory/400-32-0x00000000061D0000-0x00000000061D1000-memory.dmpFilesize
4KB
-
memory/400-18-0x0000000000000000-mapping.dmp
-
memory/400-20-0x0000000000DE0000-0x0000000000DE1000-memory.dmpFilesize
4KB
-
memory/400-19-0x0000000073910000-0x0000000073FFE000-memory.dmpFilesize
6.9MB
-
memory/400-22-0x0000000004680000-0x0000000004681000-memory.dmpFilesize
4KB
-
memory/400-21-0x0000000004940000-0x0000000004941000-memory.dmpFilesize
4KB
-
memory/400-26-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/400-55-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/400-54-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/400-40-0x0000000005660000-0x0000000005661000-memory.dmpFilesize
4KB
-
memory/400-39-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/400-31-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/400-23-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/520-57-0x0000000000401000-mapping.dmp
-
memory/556-11-0x0000000000000000-mapping.dmp
-
memory/816-2-0x0000000000000000-mapping.dmp
-
memory/832-60-0x0000000140000000-0x0000000140036000-memory.dmpFilesize
216KB
-
memory/832-59-0x0000000000000000-mapping.dmp
-
memory/1120-4-0x0000000001D70000-0x0000000001D81000-memory.dmpFilesize
68KB
-
memory/1120-8-0x0000000002040000-0x0000000002051000-memory.dmpFilesize
68KB
-
memory/1120-0-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1120-10-0x0000000002040000-0x0000000002051000-memory.dmpFilesize
68KB
-
memory/1120-5-0x0000000002180000-0x0000000002191000-memory.dmpFilesize
68KB
-
memory/1120-1-0x0000000000401000-mapping.dmp
-
memory/1120-6-0x0000000002040000-0x0000000002051000-memory.dmpFilesize
68KB
-
memory/1120-7-0x0000000002450000-0x0000000002461000-memory.dmpFilesize
68KB
-
memory/1352-3-0x0000000000000000-mapping.dmp
-
memory/1532-15-0x0000000000000000-mapping.dmp
-
memory/1640-16-0x0000000000000000-mapping.dmp
-
memory/1684-14-0x0000000000000000-mapping.dmp