| File name: | trdockfw3166.exe |
| Full analysis: | https://app.any.run/tasks/6602ef32-f33c-4d5d-bdf1-e97171d76a40 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | May 16, 2020, 08:21:54 |
| OS: | Windows 7 Professional Service Pack 1 (build: 7601, 32 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/x-dosexec |
| File info: | PE32 executable (GUI) Intel 80386, for MS Windows |
| MD5: | 40127280ADDBF78B41D451AE7A956780 |
| SHA1: | B39245F88E24918DA1120721D03653639BC6BBE0 |
| SHA256: | 7E870FAB2631EEE1959AA0796FC1E8C4B9BEB1F132CA67E8C602E5B684BAC7F0 |
| SSDEEP: | 98304:TmHP+0SEGiG5tmtqrkUohm2J04mShZjklKF8OOriKtEV8/0QBl11VNrdA553UH2v:0+vOYtcqrD4bFR8OOepVSJRLNrdM5CwV |
| .exe | | | InstallShield setup (42.2) |
|---|---|---|
| .exe | | | Win32 EXE PECompact compressed (generic) (40.8) |
| .dll | | | Win32 Dynamic Link Library (generic) (6.4) |
| .exe | | | Win32 Executable (generic) (4.4) |
| .exe | | | Win16/32 Executable Delphi generic (2) |
| MachineType: | Intel 386 or later, and compatibles |
|---|---|
| TimeStamp: | 2020:01:06 07:31:46+01:00 |
| PEType: | PE32 |
| LinkerVersion: | 2.25 |
| CodeSize: | 151552 |
| InitializedDataSize: | 27648 |
| UninitializedDataSize: | - |
| EntryPoint: | 0x25be0 |
| OSVersion: | 5 |
| ImageVersion: | 6 |
| SubsystemVersion: | 5 |
| Subsystem: | Windows GUI |
| FileVersionNumber: | 3.1.66.0 |
| ProductVersionNumber: | 3.1.66.0 |
| FileFlagsMask: | 0x003f |
| FileFlags: | (none) |
| FileOS: | Win32 |
| ObjectFileType: | Executable application |
| FileSubtype: | - |
| LanguageCode: | Neutral |
| CharacterSet: | Unicode |
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | Lenovo Group Limited |
| FileDescription: | For Lenovo Updates Catalog |
| FileVersion: | 3.1.66 |
| LegalCopyright: | Copyright © Lenovo 2005 - 2017. |
| ProductName: | ThinkPad TBT3 TR Dock FW update Tool |
| ProductVersion: | 3.1.66 |
| Architecture: | IMAGE_FILE_MACHINE_I386 |
|---|---|
| Subsystem: | IMAGE_SUBSYSTEM_WINDOWS_GUI |
| Compilation Date: | 06-Jan-2020 06:31:46 |
| Detected languages: |
|
| Comments: | This installation was built with Inno Setup. |
| CompanyName: | Lenovo Group Limited |
| FileDescription: | For Lenovo Updates Catalog |
| FileVersion: | 3.1.66 |
| LegalCopyright: | Copyright © Lenovo 2005 - 2017. |
| ProductName: | ThinkPad TBT3 TR Dock FW update Tool |
| ProductVersion: | 3.1.66 |
| Magic number: | MZ |
|---|---|
| Bytes on last page of file: | 0x0050 |
| Pages in file: | 0x0002 |
| Relocations: | 0x0000 |
| Size of header: | 0x0004 |
| Min extra paragraphs: | 0x000F |
| Max extra paragraphs: | 0xFFFF |
| Initial SS value: | 0x0000 |
| Initial SP value: | 0x00B8 |
| Checksum: | 0x0000 |
| Initial IP value: | 0x0000 |
| Initial CS value: | 0x0000 |
| Overlay number: | 0x001A |
| OEM identifier: | 0x0000 |
| OEM information: | 0x0000 |
| Address of NE header: | 0x00000100 |
| Signature: | PE |
|---|---|
| Machine: | IMAGE_FILE_MACHINE_I386 |
| Number of sections: | 10 |
| Time date stamp: | 06-Jan-2020 06:31:46 |
| Pointer to Symbol Table: | 0x00000000 |
| Number of symbols: | 0 |
| Size of Optional Header: | 0x00E0 |
| Characteristics: |
|
Name | Virtual Address | Virtual Size | Raw Size | Charateristics | Entropy |
|---|---|---|---|---|---|
.text | 0x00001000 | 0x00023AA0 | 0x00023C00 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 6.32291 |
.itext | 0x00025000 | 0x00001368 | 0x00001400 | IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ | 5.91348 |
.data | 0x00027000 | 0x00001628 | 0x00001800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 3.32921 |
.bss | 0x00029000 | 0x00006158 | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.idata | 0x00030000 | 0x00000648 | 0x00000800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.08948 |
.didata | 0x00031000 | 0x00000E3E | 0x00001000 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 4.2563 |
.edata | 0x00032000 | 0x00000071 | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 1.3265 |
.tls | 0x00033000 | 0x00000014 | 0x00000000 | IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE | 0 |
.rdata | 0x00034000 | 0x0000005D | 0x00000200 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 1.37999 |
.rsrc | 0x00035000 | 0x00003800 | 0x00003800 | IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ | 4.78881 |
Title | Entropy | Size | Codepage | Language | Type |
|---|---|---|---|---|---|
1 | 5.18481 | 2676 | UNKNOWN | English - United States | RT_MANIFEST |
2 | 3.47151 | 1384 | UNKNOWN | Dutch - Netherlands | RT_ICON |
3 | 3.91708 | 744 | UNKNOWN | Dutch - Netherlands | RT_ICON |
4 | 3.91366 | 2216 | UNKNOWN | Dutch - Netherlands | RT_ICON |
4090 | 3.19198 | 480 | UNKNOWN | UNKNOWN | RT_STRING |
4091 | 3.49576 | 404 | UNKNOWN | UNKNOWN | RT_STRING |
4092 | 3.34698 | 204 | UNKNOWN | UNKNOWN | RT_STRING |
4093 | 3.3307 | 468 | UNKNOWN | UNKNOWN | RT_STRING |
4094 | 3.29214 | 736 | UNKNOWN | UNKNOWN | RT_STRING |
4095 | 3.31877 | 852 | UNKNOWN | UNKNOWN | RT_STRING |
advapi32.dll |
comctl32.dll |
kernel32.dll |
kernel32.dll (delay-loaded) |
oleaut32.dll |
user32.dll |
Title | Ordinal | Address |
|---|---|---|
dbkFCallWrapperAddr | 1 | 0x0002C58C |
__dbk_fcall_wrapper | 2 | 0x0000B294 |
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 272 | cmd.exe /c start /b @WanaDecryptor@.exe vs | C:\Windows\system32\cmd.exe | wannacry.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Windows Command Processor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 740 | @WanaDecryptor@.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\@WanaDecryptor@.exe | — | wannacry.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Load PerfMon Counters Exit code: 3221225794 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 744 | taskdl.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\taskdl.exe | — | wannacry.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: SQL Client Configuration Utility EXE Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 968 | "C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\wannacry.exe" | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\wannacry.exe | iexplore.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: DiskPart Exit code: 1073807364 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1008 | "C:\Windows\TempInst\is-3M508.tmp\trdockfw3166.tmp" /SL5="$10013A,5690958,180224,C:\Users\admin\AppData\Local\Temp\trdockfw3166.exe" /SPAWNWND=$801C0 /NOTIFYWND=$D01A0 | C:\Windows\TempInst\is-3M508.tmp\trdockfw3166.tmp | trdockfw3166.exe | ||||||||||||
User: admin Integrity Level: HIGH Description: Setup/Uninstall Exit code: 20 Version: 51.1052.0.0 Modules
| |||||||||||||||
| 1248 | bcdedit /set {default} bootstatuspolicy ignoreallfailures | C:\Windows\system32\bcdedit.exe | — | cmd.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: HIGH Description: Boot Configuration Data Editor Exit code: 0 Version: 6.1.7601.17514 (win7sp1_rtm.101119-1850) Modules
| |||||||||||||||
| 1248 | taskdl.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\taskdl.exe | — | wannacry.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: SQL Client Configuration Utility EXE Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1452 | C:\Windows\System32\vdsldr.exe -Embedding | C:\Windows\System32\vdsldr.exe | — | svchost.exe | |||||||||||
User: SYSTEM Company: Microsoft Corporation Integrity Level: SYSTEM Description: Virtual Disk Service Loader Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 1464 | taskdl.exe | C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\taskdl.exe | — | wannacry.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: SQL Client Configuration Utility EXE Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| 2060 | reg add HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "yyibsxxiapw107" /t REG_SZ /d "\"C:\Users\admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\78RFYB7Z\tasksche.exe\"" /f | C:\Windows\system32\reg.exe | cmd.exe | ||||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Registry Console Tool Exit code: 0 Version: 6.1.7600.16385 (win7_rtm.090713-1255) Modules
| |||||||||||||||
| (PID) Process: | (1008) trdockfw3166.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Owner |
Value: F00300000AAC841B5B2BD601 | |||
| (PID) Process: | (1008) trdockfw3166.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | SessionHash |
Value: A5825AACCEEC34ACF0D1848F45904A07256BB69181DB23CF67A198FA68C943B8 | |||
| (PID) Process: | (1008) trdockfw3166.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (1008) trdockfw3166.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | RegFiles0000 |
Value: C:\Users\admin\AppData\Local\Temp\TRDockfw\TRDock_FwUpdate.exe | |||
| (PID) Process: | (1008) trdockfw3166.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | write | Name: | RegFilesHash |
Value: 67785965F3B887A2F44882C7153BFB43DCAF823FFFFDB00F05C24139F95FFF34 | |||
| (PID) Process: | (1008) trdockfw3166.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | RegFilesHash |
Value: 67785965F3B887A2F44882C7153BFB43DCAF823FFFFDB00F05C24139F95FFF34 | |||
| (PID) Process: | (1008) trdockfw3166.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | RegFiles0000 |
Value: C:\Users\admin\AppData\Local\Temp\TRDockfw\TRDock_FwUpdate.exe | |||
| (PID) Process: | (1008) trdockfw3166.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | Sequence |
Value: 1 | |||
| (PID) Process: | (1008) trdockfw3166.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | SessionHash |
Value: A5825AACCEEC34ACF0D1848F45904A07256BB69181DB23CF67A198FA68C943B8 | |||
| (PID) Process: | (1008) trdockfw3166.tmp | Key: | HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 |
| Operation: | delete value | Name: | Owner |
Value: F00300000AAC841B5B2BD601 | |||
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 1008 | trdockfw3166.tmp | C:\Users\admin\AppData\Local\Temp\TRDockfw\is-B2HQ6.tmp | — | |
MD5:— | SHA256:— | |||
| 1008 | trdockfw3166.tmp | C:\Users\admin\AppData\Local\Temp\TRDockfw\is-UBT0U.tmp | — | |
MD5:— | SHA256:— | |||
| 1008 | trdockfw3166.tmp | C:\Users\admin\AppData\Local\Temp\TRDockfw\Audio\is-TL92T.tmp | — | |
MD5:— | SHA256:— | |||
| 1008 | trdockfw3166.tmp | C:\Users\admin\AppData\Local\Temp\TRDockfw\Audio\DeviceFirmwareUpgrade.log | — | |
MD5:— | SHA256:— | |||
| 1008 | trdockfw3166.tmp | C:\Users\admin\AppData\Local\Temp\TRDockfw\Audio\is-CHHDV.tmp | — | |
MD5:— | SHA256:— | |||
| 1008 | trdockfw3166.tmp | C:\Users\admin\AppData\Local\Temp\TRDockfw\DP_HUB\is-KAVBH.tmp | — | |
MD5:— | SHA256:— | |||
| 1008 | trdockfw3166.tmp | C:\Users\admin\AppData\Local\Temp\TRDockfw\DP_HUB\is-SL1UH.tmp | — | |
MD5:— | SHA256:— | |||
| 1008 | trdockfw3166.tmp | C:\Users\admin\AppData\Local\Temp\TRDockfw\DP_HUB\is-T57PS.tmp | — | |
MD5:— | SHA256:— | |||
| 1008 | trdockfw3166.tmp | C:\Users\admin\AppData\Local\Temp\TRDockfw\DP_HUB\is-BF9FS.tmp | — | |
MD5:— | SHA256:— | |||
| 1008 | trdockfw3166.tmp | C:\Users\admin\AppData\Local\Temp\TRDockfw\DP_HUB\is-JKG03.tmp | — | |
MD5:— | SHA256:— | |||
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
2564 | iexplore.exe | GET | — | 13.107.5.80:80 | http://api.bing.com/qsml.aspx?query=about%3Ablan&maxwidth=32765&rowheight=20§ionHeight=160&FORM=IE11SS&market=en-US | US | — | — | whitelisted |
2564 | iexplore.exe | GET | — | 13.107.5.80:80 | http://api.bing.com/qsml.aspx?query=d&maxwidth=398&rowheight=20§ionHeight=160&FORM=IE11SS&market=en-US | US | — | — | whitelisted |
2564 | iexplore.exe | GET | — | 13.107.5.80:80 | http://api.bing.com/qsml.aspx?query=downlo&maxwidth=398&rowheight=20§ionHeight=160&FORM=IE11SS&market=en-US | US | — | — | whitelisted |
2564 | iexplore.exe | GET | — | 13.107.5.80:80 | http://api.bing.com/qsml.aspx?query=download+wan&maxwidth=398&rowheight=20§ionHeight=160&FORM=IE11SS&market=en-US | US | — | — | whitelisted |
2564 | iexplore.exe | GET | — | 13.107.5.80:80 | http://api.bing.com/qsml.aspx?query=download+wa&maxwidth=398&rowheight=20§ionHeight=160&FORM=IE11SS&market=en-US | US | — | — | whitelisted |
2564 | iexplore.exe | GET | — | 13.107.5.80:80 | http://api.bing.com/qsml.aspx?query=download+wann&maxwidth=398&rowheight=20§ionHeight=160&FORM=IE11SS&market=en-US | US | — | — | whitelisted |
2564 | iexplore.exe | GET | 200 | 13.107.5.80:80 | http://api.bing.com/qsml.aspx?query=do&maxwidth=398&rowheight=20§ionHeight=160&FORM=IE11SS&market=en-US | US | xml | 236 b | whitelisted |
2564 | iexplore.exe | GET | — | 13.107.5.80:80 | http://api.bing.com/qsml.aspx?query=dow&maxwidth=398&rowheight=20§ionHeight=160&FORM=IE11SS&market=en-US | US | — | — | whitelisted |
2564 | iexplore.exe | GET | 200 | 13.107.5.80:80 | http://api.bing.com/qsml.aspx?query=about%3Ab&maxwidth=32765&rowheight=20§ionHeight=160&FORM=IE11SS&market=en-US | US | xml | 252 b | whitelisted |
2564 | iexplore.exe | GET | — | 13.107.5.80:80 | http://api.bing.com/qsml.aspx?query=download+wannac&maxwidth=398&rowheight=20§ionHeight=160&FORM=IE11SS&market=en-US | US | — | — | whitelisted |
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
3168 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2564 | iexplore.exe | 13.107.5.80:80 | — | Microsoft Corporation | US | whitelisted |
2564 | iexplore.exe | 40.126.1.130:443 | api.bing.com | Microsoft Corporation | US | malicious |
2564 | iexplore.exe | 40.90.23.153:443 | login.live.com | Microsoft Corporation | US | unknown |
2564 | iexplore.exe | 204.79.197.200:80 | www.bing.com | Microsoft Corporation | US | whitelisted |
2564 | iexplore.exe | 93.184.220.29:80 | ocsp.digicert.com | MCI Communications Services, Inc. d/b/a Verizon Business | US | whitelisted |
2564 | iexplore.exe | 204.79.197.200:443 | www.bing.com | Microsoft Corporation | US | whitelisted |
2564 | iexplore.exe | 204.79.197.222:80 | 4a8b00d64c9ef7b179275857353c7b0e.clo.footprintdns.com | Microsoft Corporation | US | whitelisted |
2564 | iexplore.exe | 20.36.40.51:80 | 70db8e566c6869ca0dfc9de71fef2672.clo.footprintdns.com | — | US | unknown |
2564 | iexplore.exe | 176.9.61.4:80 | originaldll.com | Hetzner Online GmbH | DE | suspicious |
Domain | IP | Reputation |
|---|---|---|
www.bing.com |
| whitelisted |
api.bing.com |
| whitelisted |
login.microsoftonline.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
70db8e566c6869ca0dfc9de71fef2672.clo.footprintdns.com |
| unknown |
www2.bing.com |
| whitelisted |
4a8b00d64c9ef7b179275857353c7b0e.clo.footprintdns.com |
| suspicious |
4c5588a5d3518c07f6bd31ede6c7bc99.clo.footprintdns.com |
| unknown |
fp.msedge.net |
| whitelisted |
PID | Process | Class | Message |
|---|---|---|---|
2564 | iexplore.exe | Potential Corporate Privacy Violation | ET POLICY PE EXE or DLL Windows file download HTTP |
2564 | iexplore.exe | Misc activity | ET INFO EXE - Served Attached HTTP |
2356 | taskhsvc.exe | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 622 |
2356 | taskhsvc.exe | Misc activity | ET POLICY TLS possible TOR SSL traffic |
2356 | taskhsvc.exe | Misc activity | ET POLICY TLS possible TOR SSL traffic |
2356 | taskhsvc.exe | Potential Corporate Privacy Violation | POLICY [PTsecurity] TOR SSL connection |
2356 | taskhsvc.exe | Misc activity | ET POLICY TLS possible TOR SSL traffic |
2356 | taskhsvc.exe | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 695 |
2356 | taskhsvc.exe | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 615 |
2356 | taskhsvc.exe | Misc Attack | ET TOR Known Tor Relay/Router (Not Exit) Node Traffic group 155 |
Process | Message |
|---|---|
TRDock_FwUpdate.exe | {308} |
TRDock_FwUpdate.exe | {486} |
TRDock_FwUpdate.exe | Dumping objects ->
|
TRDock_FwUpdate.exe | normal block at 0x001D40F8, 34 bytes long.
|
TRDock_FwUpdate.exe | c:\work\thunder bolt\firmware\fw update tool\combined\trdock_fwupdate3166_0110_via5113baseon0107\trdock_fwupdate\trdock_fwupdate\ui_mainwnd.cpp(322) : |
TRDock_FwUpdate.exe | c:\work\thunder bolt\firmware\fw update tool\combined\trdock_fwupdate3166_0110_via5113baseon0107\trdock_fwupdate\trdock_fwupdate\ui_mainwnd.cpp(303) : |
TRDock_FwUpdate.exe | client block at 0x001DC930, subtype c0, 8 bytes long.
|
TRDock_FwUpdate.exe | {304} |
TRDock_FwUpdate.exe | {306} |
TRDock_FwUpdate.exe | Detected memory leaks!
|