Analysis
-
max time kernel
135s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25-05-2024 00:01
Behavioral task
behavioral1
Sample
83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe
Resource
win7-20240508-en
General
-
Target
83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe
-
Size
1.2MB
-
MD5
0c0f676f6c3bcd61937ea706a89a3272
-
SHA1
e2cf3f0092ae306d5d1e68660a64980cd49ef7af
-
SHA256
83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874
-
SHA512
ae701c36c6b8860ac85300d47a5738c59398bd169f1b2aee7c93b493f52fd10efe43eea4cc5a9f7781f0762d8b9ccf18def3c66bbde35037c061927caa034441
-
SSDEEP
24576:zQ5aILMCfmAUjzX6xQt+4En+bcMAOxA5zYlo1c51WnSx:E5aIwC+Agr6StVEnmcKxY/O1B
Malware Config
Signatures
-
KPOT Core Executable 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\WinSocket\93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe family_kpot -
Trickbot x86 loader 1 IoCs
Detected Trickbot's x86 loader that unpacks the x86 payload.
Processes:
resource yara_rule behavioral1/memory/836-15-0x0000000000350000-0x0000000000379000-memory.dmp trickbot_loader32 -
Executes dropped EXE 3 IoCs
Processes:
93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exepid process 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 2408 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 2332 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe -
Loads dropped DLL 2 IoCs
Processes:
83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exepid process 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.exedescription ioc process File opened for modification C:\Windows\SysWOW64\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Launches sc.exe 2 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exesc.exepid process 2664 sc.exe 2640 sc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exepowershell.exepid process 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 2892 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exe93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exedescription pid process Token: SeDebugPrivilege 2892 powershell.exe Token: SeTcbPrivilege 2408 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe Token: SeTcbPrivilege 2332 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exepid process 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 2408 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe 2332 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.execmd.execmd.execmd.exe93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exetaskeng.exe93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exedescription pid process target process PID 836 wrote to memory of 3036 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe cmd.exe PID 836 wrote to memory of 3036 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe cmd.exe PID 836 wrote to memory of 3036 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe cmd.exe PID 836 wrote to memory of 3036 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe cmd.exe PID 836 wrote to memory of 2796 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe cmd.exe PID 836 wrote to memory of 2796 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe cmd.exe PID 836 wrote to memory of 2796 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe cmd.exe PID 836 wrote to memory of 2796 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe cmd.exe PID 836 wrote to memory of 2604 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe cmd.exe PID 836 wrote to memory of 2604 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe cmd.exe PID 836 wrote to memory of 2604 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe cmd.exe PID 836 wrote to memory of 2604 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe cmd.exe PID 836 wrote to memory of 2744 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe PID 836 wrote to memory of 2744 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe PID 836 wrote to memory of 2744 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe PID 836 wrote to memory of 2744 836 83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe PID 3036 wrote to memory of 2664 3036 cmd.exe sc.exe PID 3036 wrote to memory of 2664 3036 cmd.exe sc.exe PID 3036 wrote to memory of 2664 3036 cmd.exe sc.exe PID 3036 wrote to memory of 2664 3036 cmd.exe sc.exe PID 2796 wrote to memory of 2640 2796 cmd.exe sc.exe PID 2796 wrote to memory of 2640 2796 cmd.exe sc.exe PID 2796 wrote to memory of 2640 2796 cmd.exe sc.exe PID 2796 wrote to memory of 2640 2796 cmd.exe sc.exe PID 2604 wrote to memory of 2892 2604 cmd.exe powershell.exe PID 2604 wrote to memory of 2892 2604 cmd.exe powershell.exe PID 2604 wrote to memory of 2892 2604 cmd.exe powershell.exe PID 2604 wrote to memory of 2892 2604 cmd.exe powershell.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2744 wrote to memory of 2704 2744 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2488 wrote to memory of 2408 2488 taskeng.exe 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe PID 2488 wrote to memory of 2408 2488 taskeng.exe 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe PID 2488 wrote to memory of 2408 2488 taskeng.exe 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe PID 2488 wrote to memory of 2408 2488 taskeng.exe 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe PID 2408 wrote to memory of 2340 2408 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2408 wrote to memory of 2340 2408 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2408 wrote to memory of 2340 2408 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe PID 2408 wrote to memory of 2340 2408 93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe svchost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe"C:\Users\Admin\AppData\Local\Temp\83e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c sc stop WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop WinDefend3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c sc delete WinDefend2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc delete WinDefend3⤵
- Launches sc.exe
-
C:\Windows\SysWOW64\cmd.exe/c powershell Set-MpPreference -DisableRealtimeMonitoring $true2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\WinSocket\93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exeC:\Users\Admin\AppData\Roaming\WinSocket\93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {5FBB954B-E07E-42B3-B92F-4665D1869A95} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinSocket\93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exeC:\Users\Admin\AppData\Roaming\WinSocket\93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
-
C:\Users\Admin\AppData\Roaming\WinSocket\93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exeC:\Users\Admin\AppData\Roaming\WinSocket\93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Roaming\WinSocket\93e93708db9363b1fbaca2e1b2bc86b99d92614b9919f9186aa22868896dd984.exeFilesize
1.2MB
MD50c0f676f6c3bcd61937ea706a89a3272
SHA1e2cf3f0092ae306d5d1e68660a64980cd49ef7af
SHA25683e83607db8353b1fbaca2e1b2bc75b88d92514b9919f9175aa22757795dd874
SHA512ae701c36c6b8860ac85300d47a5738c59398bd169f1b2aee7c93b493f52fd10efe43eea4cc5a9f7781f0762d8b9ccf18def3c66bbde35037c061927caa034441
-
memory/836-17-0x0000000000421000-0x0000000000422000-memory.dmpFilesize
4KB
-
memory/836-12-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/836-14-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/836-11-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/836-10-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/836-9-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/836-8-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/836-7-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/836-6-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/836-5-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/836-4-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/836-3-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/836-2-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/836-18-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/836-15-0x0000000000350000-0x0000000000379000-memory.dmpFilesize
164KB
-
memory/836-13-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2408-67-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/2408-66-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/2408-63-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/2408-64-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/2408-65-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/2408-61-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/2408-62-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/2408-72-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/2408-70-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/2408-69-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/2408-68-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/2408-71-0x0000000000590000-0x0000000000591000-memory.dmpFilesize
4KB
-
memory/2704-49-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/2704-50-0x0000000010000000-0x000000001001E000-memory.dmpFilesize
120KB
-
memory/2744-36-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2744-44-0x0000000000400000-0x0000000000472000-memory.dmpFilesize
456KB
-
memory/2744-46-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/2744-45-0x0000000010000000-0x0000000010007000-memory.dmpFilesize
28KB
-
memory/2744-30-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2744-31-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2744-32-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2744-33-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2744-34-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2744-35-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2744-37-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2744-38-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2744-39-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2744-40-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2744-41-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB