Analysis
-
max time kernel
154s -
max time network
154s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
06-12-2021 03:14
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe
Resource
win7-en-20211104
General
-
Target
SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe
-
Size
5.4MB
-
MD5
5748009f0073ba952cbb581c44530798
-
SHA1
3304676ed8a238bf792a0fa359708861b3bfd42a
-
SHA256
4535de41278b2d4487e8f51de5851d8623de81e68060fe42d9ecb2cc23c4ed06
-
SHA512
03b13118184ea701e9257e2e9cc9698dffadfcd42276a3771477c95ff6e4351500ce85563444ccc98f948ae91c1ed6f6969ad33437105016c74a7e96adf0febf
Malware Config
Signatures
-
XMRig Miner Payload 12 IoCs
Processes:
resource yara_rule behavioral1/memory/1732-114-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/1732-115-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/1732-116-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/1732-117-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/1732-118-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/1732-119-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/1732-120-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/1732-121-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/1732-122-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/1732-123-0x0000000140000000-0x0000000140787000-memory.dmp xmrig behavioral1/memory/1732-124-0x0000000140310068-mapping.dmp xmrig behavioral1/memory/1732-126-0x0000000140000000-0x0000000140787000-memory.dmp xmrig -
Executes dropped EXE 2 IoCs
Processes:
services64.exesihost64.exepid process 1396 services64.exe 972 sihost64.exe -
Loads dropped DLL 2 IoCs
Processes:
cmd.exeservices64.exepid process 1764 cmd.exe 1396 services64.exe -
Drops file in System32 directory 4 IoCs
Processes:
powershell.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
services64.exedescription pid process target process PID 1396 set thread context of 1732 1396 services64.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
Processes:
powershell.exepowershell.exeSecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exepowershell.exepowershell.exeservices64.exesvchost.exepid process 1380 powershell.exe 968 powershell.exe 336 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe 1484 powershell.exe 868 powershell.exe 1396 services64.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe 1732 svchost.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
powershell.exepowershell.exeSecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exepowershell.exepowershell.exeservices64.exesvchost.exedescription pid process Token: SeDebugPrivilege 1380 powershell.exe Token: SeDebugPrivilege 968 powershell.exe Token: SeDebugPrivilege 336 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe Token: SeDebugPrivilege 1484 powershell.exe Token: SeDebugPrivilege 868 powershell.exe Token: SeDebugPrivilege 1396 services64.exe Token: SeLockMemoryPrivilege 1732 svchost.exe Token: SeLockMemoryPrivilege 1732 svchost.exe -
Suspicious use of WriteProcessMemory 53 IoCs
Processes:
SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.execmd.execmd.execmd.exeservices64.execmd.exesihost64.exedescription pid process target process PID 336 wrote to memory of 1268 336 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe cmd.exe PID 336 wrote to memory of 1268 336 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe cmd.exe PID 336 wrote to memory of 1268 336 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe cmd.exe PID 1268 wrote to memory of 1380 1268 cmd.exe powershell.exe PID 1268 wrote to memory of 1380 1268 cmd.exe powershell.exe PID 1268 wrote to memory of 1380 1268 cmd.exe powershell.exe PID 1268 wrote to memory of 968 1268 cmd.exe powershell.exe PID 1268 wrote to memory of 968 1268 cmd.exe powershell.exe PID 1268 wrote to memory of 968 1268 cmd.exe powershell.exe PID 336 wrote to memory of 460 336 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe cmd.exe PID 336 wrote to memory of 460 336 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe cmd.exe PID 336 wrote to memory of 460 336 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe cmd.exe PID 460 wrote to memory of 1852 460 cmd.exe schtasks.exe PID 460 wrote to memory of 1852 460 cmd.exe schtasks.exe PID 460 wrote to memory of 1852 460 cmd.exe schtasks.exe PID 336 wrote to memory of 1764 336 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe cmd.exe PID 336 wrote to memory of 1764 336 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe cmd.exe PID 336 wrote to memory of 1764 336 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe cmd.exe PID 1764 wrote to memory of 1396 1764 cmd.exe services64.exe PID 1764 wrote to memory of 1396 1764 cmd.exe services64.exe PID 1764 wrote to memory of 1396 1764 cmd.exe services64.exe PID 1396 wrote to memory of 1772 1396 services64.exe cmd.exe PID 1396 wrote to memory of 1772 1396 services64.exe cmd.exe PID 1396 wrote to memory of 1772 1396 services64.exe cmd.exe PID 1772 wrote to memory of 1484 1772 cmd.exe powershell.exe PID 1772 wrote to memory of 1484 1772 cmd.exe powershell.exe PID 1772 wrote to memory of 1484 1772 cmd.exe powershell.exe PID 1772 wrote to memory of 868 1772 cmd.exe powershell.exe PID 1772 wrote to memory of 868 1772 cmd.exe powershell.exe PID 1772 wrote to memory of 868 1772 cmd.exe powershell.exe PID 1396 wrote to memory of 972 1396 services64.exe sihost64.exe PID 1396 wrote to memory of 972 1396 services64.exe sihost64.exe PID 1396 wrote to memory of 972 1396 services64.exe sihost64.exe PID 1396 wrote to memory of 1732 1396 services64.exe svchost.exe PID 1396 wrote to memory of 1732 1396 services64.exe svchost.exe PID 1396 wrote to memory of 1732 1396 services64.exe svchost.exe PID 1396 wrote to memory of 1732 1396 services64.exe svchost.exe PID 1396 wrote to memory of 1732 1396 services64.exe svchost.exe PID 1396 wrote to memory of 1732 1396 services64.exe svchost.exe PID 1396 wrote to memory of 1732 1396 services64.exe svchost.exe PID 1396 wrote to memory of 1732 1396 services64.exe svchost.exe PID 1396 wrote to memory of 1732 1396 services64.exe svchost.exe PID 1396 wrote to memory of 1732 1396 services64.exe svchost.exe PID 1396 wrote to memory of 1732 1396 services64.exe svchost.exe PID 1396 wrote to memory of 1732 1396 services64.exe svchost.exe PID 1396 wrote to memory of 1732 1396 services64.exe svchost.exe PID 1396 wrote to memory of 1732 1396 services64.exe svchost.exe PID 1396 wrote to memory of 1732 1396 services64.exe svchost.exe PID 1396 wrote to memory of 1732 1396 services64.exe svchost.exe PID 972 wrote to memory of 1736 972 sihost64.exe conhost.exe PID 972 wrote to memory of 1736 972 sihost64.exe conhost.exe PID 972 wrote to memory of 1736 972 sihost64.exe conhost.exe PID 972 wrote to memory of 1736 972 sihost64.exe conhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="3⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\Microsoft\services64.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\Microsoft\services64.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\cmd.exe"cmd" cmd /c "C:\Users\Admin\Microsoft\services64.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Microsoft\services64.exeC:\Users\Admin\Microsoft\services64.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="5⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "mlqowtwyezocuz"5⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe rdwexnmbexgwvux0 Xji3FXYfqqI2timPThbgZueMNpSES88mLhMz2ywydJRha9S4YJkR8/KlqFio/vzAY7y//ZROYnArPXLiffwPB3EYEaWtdTNgeO+yOcML2FLdin0Rbrrbm/YoAjK7mqvZEX/HgK//sgsnHcQsRkM9iGKCen+11TiuyHWyZAdf1wMLE4agYXDET+uLyuqzRfvjrbqdOzrMw7uyk9GJnctDF8x49xwghsNTxALZT8Q9OM4wOBYwE039IMn9ca6XIbihdWj5HyYAJaQbSZphwh7fCuYt0jnCH0tNapinYPmpr65hdz5iy8i4gYX/G2mW0bWM7v5yf7/M2g2SVIovCp85oojSagGHvGHL9NSpcgvmBfYrdWxs22CrpiqlLHwgNqOtzxdN5e8kce4ENimY0bna8qreUya9Oikcj5lQ/56VmmV9Rh/Te8Hm+EfV7aQGkEt7MvpdIliJYJQpq2Rqw4034WTmYmYIyNc1KTfSbRTTojhYmzmEfUwH1A/sCOYdzo1OYQdU8gUbDvK3Kvse8WXom5OTFAiqYFmnf8ovp3DqBcmGqaVa1ozl51yTYaQREubTK3akW3GhtG5yyHb2vOLHgRrAgqZDab/X7gLYtnofzkqda7eCFUGhOiP05JYct6ux4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exeMD5
9f196bd28274bbf24456746341db2b25
SHA13bd9a482dc88a6bd42465cb37c3d288a180386e0
SHA256ee183792c122aed123b5b7e111911a5d61fef56053449d5cc11c262c1315c9cc
SHA5125e2753c621534b14e5457ca81246cc17b00b55facc4a733d87e094ee63fb5afc51273d3a2ea94207abf01e211e911e2cd33f7895a3d13266c9544b87a39b4b56
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
cda9f3a8ad4e5c6b6b128ebfbed8ac8c
SHA1e8f9a956535a61ea0d1e1b19fcaa01131659b931
SHA256f7088eb417a8353f1ef64ca96642b3f32e3d53db562ccc30521a61133f35e981
SHA5127c97baf9df8cbcf3c8184d82ad4f4c266dac3c1fa45cab6123c4b0f3e92cb10c7b3c7e490f11deb9f1b1c40b5e7743437724c4267655b8f19a17a52d59b47115
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
cda9f3a8ad4e5c6b6b128ebfbed8ac8c
SHA1e8f9a956535a61ea0d1e1b19fcaa01131659b931
SHA256f7088eb417a8353f1ef64ca96642b3f32e3d53db562ccc30521a61133f35e981
SHA5127c97baf9df8cbcf3c8184d82ad4f4c266dac3c1fa45cab6123c4b0f3e92cb10c7b3c7e490f11deb9f1b1c40b5e7743437724c4267655b8f19a17a52d59b47115
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msMD5
cda9f3a8ad4e5c6b6b128ebfbed8ac8c
SHA1e8f9a956535a61ea0d1e1b19fcaa01131659b931
SHA256f7088eb417a8353f1ef64ca96642b3f32e3d53db562ccc30521a61133f35e981
SHA5127c97baf9df8cbcf3c8184d82ad4f4c266dac3c1fa45cab6123c4b0f3e92cb10c7b3c7e490f11deb9f1b1c40b5e7743437724c4267655b8f19a17a52d59b47115
-
C:\Users\Admin\Microsoft\services64.exeMD5
5748009f0073ba952cbb581c44530798
SHA13304676ed8a238bf792a0fa359708861b3bfd42a
SHA2564535de41278b2d4487e8f51de5851d8623de81e68060fe42d9ecb2cc23c4ed06
SHA51203b13118184ea701e9257e2e9cc9698dffadfcd42276a3771477c95ff6e4351500ce85563444ccc98f948ae91c1ed6f6969ad33437105016c74a7e96adf0febf
-
C:\Users\Admin\Microsoft\services64.exeMD5
5748009f0073ba952cbb581c44530798
SHA13304676ed8a238bf792a0fa359708861b3bfd42a
SHA2564535de41278b2d4487e8f51de5851d8623de81e68060fe42d9ecb2cc23c4ed06
SHA51203b13118184ea701e9257e2e9cc9698dffadfcd42276a3771477c95ff6e4351500ce85563444ccc98f948ae91c1ed6f6969ad33437105016c74a7e96adf0febf
-
\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exeMD5
9f196bd28274bbf24456746341db2b25
SHA13bd9a482dc88a6bd42465cb37c3d288a180386e0
SHA256ee183792c122aed123b5b7e111911a5d61fef56053449d5cc11c262c1315c9cc
SHA5125e2753c621534b14e5457ca81246cc17b00b55facc4a733d87e094ee63fb5afc51273d3a2ea94207abf01e211e911e2cd33f7895a3d13266c9544b87a39b4b56
-
\Users\Admin\Microsoft\services64.exeMD5
5748009f0073ba952cbb581c44530798
SHA13304676ed8a238bf792a0fa359708861b3bfd42a
SHA2564535de41278b2d4487e8f51de5851d8623de81e68060fe42d9ecb2cc23c4ed06
SHA51203b13118184ea701e9257e2e9cc9698dffadfcd42276a3771477c95ff6e4351500ce85563444ccc98f948ae91c1ed6f6969ad33437105016c74a7e96adf0febf
-
memory/336-65-0x000000001C4A7000-0x000000001C4A8000-memory.dmpFilesize
4KB
-
memory/336-64-0x000000001C4A6000-0x000000001C4A7000-memory.dmpFilesize
4KB
-
memory/336-63-0x000000001C4A4000-0x000000001C4A6000-memory.dmpFilesize
8KB
-
memory/336-58-0x000000001C4A2000-0x000000001C4A4000-memory.dmpFilesize
8KB
-
memory/336-56-0x000000001C930000-0x000000001CD33000-memory.dmpFilesize
4.0MB
-
memory/336-55-0x0000000000AB0000-0x0000000000EB7000-memory.dmpFilesize
4.0MB
-
memory/460-78-0x0000000000000000-mapping.dmp
-
memory/868-99-0x0000000000000000-mapping.dmp
-
memory/868-104-0x00000000023D0000-0x00000000023D2000-memory.dmpFilesize
8KB
-
memory/868-105-0x00000000023D2000-0x00000000023D4000-memory.dmpFilesize
8KB
-
memory/868-106-0x00000000023D4000-0x00000000023D7000-memory.dmpFilesize
12KB
-
memory/868-107-0x00000000023DB000-0x00000000023FA000-memory.dmpFilesize
124KB
-
memory/868-103-0x000007FEEB320000-0x000007FEEBE7D000-memory.dmpFilesize
11.4MB
-
memory/968-70-0x0000000000000000-mapping.dmp
-
memory/968-77-0x00000000026DB000-0x00000000026FA000-memory.dmpFilesize
124KB
-
memory/968-73-0x000007FEEB8D0000-0x000007FEEC42D000-memory.dmpFilesize
11.4MB
-
memory/968-74-0x00000000026D0000-0x00000000026D2000-memory.dmpFilesize
8KB
-
memory/968-76-0x00000000026D4000-0x00000000026D7000-memory.dmpFilesize
12KB
-
memory/968-75-0x00000000026D2000-0x00000000026D4000-memory.dmpFilesize
8KB
-
memory/972-109-0x0000000000000000-mapping.dmp
-
memory/1268-59-0x0000000000000000-mapping.dmp
-
memory/1380-68-0x00000000026E2000-0x00000000026E4000-memory.dmpFilesize
8KB
-
memory/1380-67-0x00000000026E0000-0x00000000026E2000-memory.dmpFilesize
8KB
-
memory/1380-69-0x00000000026E4000-0x00000000026E7000-memory.dmpFilesize
12KB
-
memory/1380-66-0x00000000026EB000-0x000000000270A000-memory.dmpFilesize
124KB
-
memory/1380-62-0x000007FEEB8D0000-0x000007FEEC42D000-memory.dmpFilesize
11.4MB
-
memory/1380-61-0x000007FEFB9A1000-0x000007FEFB9A3000-memory.dmpFilesize
8KB
-
memory/1380-60-0x0000000000000000-mapping.dmp
-
memory/1396-92-0x000000001C306000-0x000000001C307000-memory.dmpFilesize
4KB
-
memory/1396-93-0x000000001C307000-0x000000001C308000-memory.dmpFilesize
4KB
-
memory/1396-89-0x000000001C302000-0x000000001C304000-memory.dmpFilesize
8KB
-
memory/1396-90-0x000000001C304000-0x000000001C306000-memory.dmpFilesize
8KB
-
memory/1396-82-0x0000000000000000-mapping.dmp
-
memory/1484-97-0x00000000029A2000-0x00000000029A4000-memory.dmpFilesize
8KB
-
memory/1484-101-0x00000000029AB000-0x00000000029CA000-memory.dmpFilesize
124KB
-
memory/1484-95-0x000000001B760000-0x000000001BA5F000-memory.dmpFilesize
3.0MB
-
memory/1484-98-0x00000000029A4000-0x00000000029A7000-memory.dmpFilesize
12KB
-
memory/1484-96-0x00000000029A0000-0x00000000029A2000-memory.dmpFilesize
8KB
-
memory/1484-94-0x000007FEEB320000-0x000007FEEBE7D000-memory.dmpFilesize
11.4MB
-
memory/1484-87-0x0000000000000000-mapping.dmp
-
memory/1732-119-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/1732-122-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/1732-111-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/1732-112-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/1732-113-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/1732-114-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/1732-115-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/1732-116-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/1732-117-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/1732-118-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/1732-135-0x00000000003E0000-0x0000000000400000-memory.dmpFilesize
128KB
-
memory/1732-120-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/1732-121-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/1732-126-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/1732-123-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/1732-124-0x0000000140310068-mapping.dmp
-
memory/1732-125-0x00000000001E0000-0x0000000000200000-memory.dmpFilesize
128KB
-
memory/1736-127-0x00000000001C0000-0x00000000001C3000-memory.dmpFilesize
12KB
-
memory/1736-130-0x0000000000060000-0x0000000000067000-memory.dmpFilesize
28KB
-
memory/1736-131-0x0000000002192000-0x0000000002194000-memory.dmpFilesize
8KB
-
memory/1736-132-0x0000000002194000-0x0000000002196000-memory.dmpFilesize
8KB
-
memory/1736-133-0x0000000002196000-0x0000000002197000-memory.dmpFilesize
4KB
-
memory/1736-134-0x0000000002197000-0x0000000002198000-memory.dmpFilesize
4KB
-
memory/1764-80-0x0000000000000000-mapping.dmp
-
memory/1772-86-0x0000000000000000-mapping.dmp
-
memory/1852-79-0x0000000000000000-mapping.dmp