Analysis
-
max time kernel
135s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
28-04-2024 19:07
Behavioral task
behavioral1
Sample
1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe
Resource
win7-20240220-en
General
-
Target
1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe
-
Size
1.3MB
-
MD5
84de465e1371fb25c168f98dd178fabd
-
SHA1
887622bbaa55a205bbe91da2e5fe4ad45fb38fa4
-
SHA256
1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21
-
SHA512
29e53581cfb76cf0a87490fb01a21a2ffee347924fdea1489e2656fb6fc47f54c3f0dc1b80413e26c5538d8dbdf6774d0e8f6ec621978fd480b979529a3d2125
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQGCZLFdGm1SdrzRjVYaQ/n2lbcMfcFBg:E5aIwC+Agr6S/FYqOc2Sg
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\WinSocket\1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe family_kpot -
Trickbot x86 loader 3 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/2156-15-0x0000000000290000-0x00000000002B9000-memory.dmp trickbot_loader32 behavioral1/memory/2156-19-0x0000000000290000-0x00000000002B9000-memory.dmp trickbot_loader32 behavioral1/memory/2156-27-0x0000000000290000-0x00000000002B9000-memory.dmp trickbot_loader32 -
Stops running service(s) 3 TTPs
-
Executes dropped EXE 3 IoCs
Processes:
1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exepid process 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe 1616 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe 1100 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe -
Loads dropped DLL 2 IoCs
Processes:
1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exepid process 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 2540 sc.exe 2612 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exepowershell.exepid process 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe 2532 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exe1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exedescription pid process Token: SeDebugPrivilege 2532 powershell.exe Token: SeTcbPrivilege 1616 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe Token: SeTcbPrivilege 1100 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exepid process 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe 1616 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe 1100 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.execmd.execmd.execmd.exe1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exetaskeng.exe1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exedescription pid process target process PID 2156 wrote to memory of 2524 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe cmd.exe PID 2156 wrote to memory of 2524 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe cmd.exe PID 2156 wrote to memory of 2524 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe cmd.exe PID 2156 wrote to memory of 2524 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe cmd.exe PID 2156 wrote to memory of 2556 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe cmd.exe PID 2156 wrote to memory of 2556 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe cmd.exe PID 2156 wrote to memory of 2556 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe cmd.exe PID 2156 wrote to memory of 2556 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe cmd.exe PID 2156 wrote to memory of 2688 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe cmd.exe PID 2156 wrote to memory of 2688 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe cmd.exe PID 2156 wrote to memory of 2688 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe cmd.exe PID 2156 wrote to memory of 2688 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe cmd.exe PID 2156 wrote to memory of 2736 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe PID 2156 wrote to memory of 2736 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe PID 2156 wrote to memory of 2736 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe PID 2156 wrote to memory of 2736 2156 1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe PID 2524 wrote to memory of 2612 2524 cmd.exe sc.exe PID 2524 wrote to memory of 2612 2524 cmd.exe sc.exe PID 2524 wrote to memory of 2612 2524 cmd.exe sc.exe PID 2524 wrote to memory of 2612 2524 cmd.exe sc.exe PID 2556 wrote to memory of 2540 2556 cmd.exe sc.exe PID 2556 wrote to memory of 2540 2556 cmd.exe sc.exe PID 2556 wrote to memory of 2540 2556 cmd.exe sc.exe PID 2556 wrote to memory of 2540 2556 cmd.exe sc.exe PID 2688 wrote to memory of 2532 2688 cmd.exe powershell.exe PID 2688 wrote to memory of 2532 2688 cmd.exe powershell.exe PID 2688 wrote to memory of 2532 2688 cmd.exe powershell.exe PID 2688 wrote to memory of 2532 2688 cmd.exe powershell.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 2736 wrote to memory of 2448 2736 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 1612 wrote to memory of 1616 1612 taskeng.exe 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe PID 1612 wrote to memory of 1616 1612 taskeng.exe 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe PID 1612 wrote to memory of 1616 1612 taskeng.exe 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe PID 1612 wrote to memory of 1616 1612 taskeng.exe 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe PID 1616 wrote to memory of 2084 1616 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 1616 wrote to memory of 2084 1616 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 1616 wrote to memory of 2084 1616 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe PID 1616 wrote to memory of 2084 1616 1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe"C:\Users\Admin\AppData\Local\Temp\1b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\WinSocket\1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exeC:\Users\Admin\AppData\Roaming\WinSocket\1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {61D02F38-5F97-498A-BDD3-7C33FDA795FA} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinSocket\1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exeC:\Users\Admin\AppData\Roaming\WinSocket\1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exeC:\Users\Admin\AppData\Roaming\WinSocket\1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\WinSocket\1b63f0273029639f1b710a3d9c009a69c02d0d9a2eac904ac7a924fd990e1c21.exeFilesize
1.3MB
MD584de465e1371fb25c168f98dd178fabd
SHA1887622bbaa55a205bbe91da2e5fe4ad45fb38fa4
SHA2561b53f0263028538f1b610a3d9c008a59c02d0d8a2eac904ac6a824fd890e1c21
SHA51229e53581cfb76cf0a87490fb01a21a2ffee347924fdea1489e2656fb6fc47f54c3f0dc1b80413e26c5538d8dbdf6774d0e8f6ec621978fd480b979529a3d2125
-
memory/1100-89-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/1100-90-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/1616-66-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1616-68-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1616-69-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1616-70-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1616-72-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1616-73-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1616-71-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1616-67-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1616-65-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1616-64-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1616-63-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/1616-62-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2156-7-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2156-11-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2156-18-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2156-27-0x0000000000290000-0x00000000002B9000-memory.dmpFilesize
164KB
-
memory/2156-3-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2156-14-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2156-13-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2156-19-0x0000000000290000-0x00000000002B9000-memory.dmpFilesize
164KB
-
memory/2156-4-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2156-5-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2156-6-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2156-15-0x0000000000290000-0x00000000002B9000-memory.dmpFilesize
164KB
-
memory/2156-2-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2156-8-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2156-9-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2156-10-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2156-17-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2156-12-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/2448-50-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/2448-51-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/2736-47-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB