Analysis
-
max time kernel
139s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
04-03-2021 14:50
Static task
static1
Behavioral task
behavioral1
Sample
8343d0955b6e122e915e7c381d597f60eeb96b18c9069bc35276c04e0fe52448.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
8343d0955b6e122e915e7c381d597f60eeb96b18c9069bc35276c04e0fe52448.bin.exe
Resource
win10v20201028
General
-
Target
8343d0955b6e122e915e7c381d597f60eeb96b18c9069bc35276c04e0fe52448.bin.exe
-
Size
199KB
-
MD5
694aeb997cad16f5d2a82fe34447c2f5
-
SHA1
99151301e07d13301ce5a579d087b6a78389c38b
-
SHA256
8343d0955b6e122e915e7c381d597f60eeb96b18c9069bc35276c04e0fe52448
-
SHA512
f0979eea4e1b2141442d48f6b84b76d2dfae24f59df6b5e9446c4652e566415bc09e2a9d8ca5628fbfc7e260e5d2a5992023bcd5a13f980ebf204c2d80ff95ba
Malware Config
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
DiamondFox payload 5 IoCs
Detects DiamondFox payload in file/memory.
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe diamondfox C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe diamondfox C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe diamondfox C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe diamondfox C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe diamondfox -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/2108-17-0x0000000000400000-0x000000000047C000-memory.dmp WebBrowserPassView behavioral2/memory/2108-18-0x00000000004466F4-mapping.dmp WebBrowserPassView behavioral2/memory/2108-22-0x0000000000400000-0x000000000047C000-memory.dmp WebBrowserPassView -
Nirsoft 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2108-17-0x0000000000400000-0x000000000047C000-memory.dmp Nirsoft behavioral2/memory/2108-18-0x00000000004466F4-mapping.dmp Nirsoft behavioral2/memory/2108-22-0x0000000000400000-0x000000000047C000-memory.dmp Nirsoft -
Executes dropped EXE 4 IoCs
Processes:
MicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exepid process 3120 MicrosoftEdgeCPS.exe 1612 MicrosoftEdgeCPS.exe 2108 MicrosoftEdgeCPS.exe 3548 MicrosoftEdgeCPS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 17 IoCs
Processes:
MicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exedescription pid process target process PID 3120 set thread context of 1612 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 set thread context of 2108 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 set thread context of 3548 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1612 set thread context of 3780 1612 MicrosoftEdgeCPS.exe WerFault.exe PID 3120 set thread context of 0 3120 MicrosoftEdgeCPS.exe PID 3120 set thread context of 0 3120 MicrosoftEdgeCPS.exe PID 3120 set thread context of 0 3120 MicrosoftEdgeCPS.exe PID 3120 set thread context of 0 3120 MicrosoftEdgeCPS.exe PID 3120 set thread context of 0 3120 MicrosoftEdgeCPS.exe PID 3120 set thread context of 0 3120 MicrosoftEdgeCPS.exe PID 3120 set thread context of 0 3120 MicrosoftEdgeCPS.exe PID 3120 set thread context of 0 3120 MicrosoftEdgeCPS.exe PID 3120 set thread context of 0 3120 MicrosoftEdgeCPS.exe PID 3120 set thread context of 0 3120 MicrosoftEdgeCPS.exe PID 3120 set thread context of 0 3120 MicrosoftEdgeCPS.exe PID 3120 set thread context of 0 3120 MicrosoftEdgeCPS.exe PID 3120 set thread context of 0 3120 MicrosoftEdgeCPS.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
MicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exepid process 3120 MicrosoftEdgeCPS.exe 3120 MicrosoftEdgeCPS.exe 2108 MicrosoftEdgeCPS.exe 2108 MicrosoftEdgeCPS.exe 2108 MicrosoftEdgeCPS.exe 2108 MicrosoftEdgeCPS.exe 3120 MicrosoftEdgeCPS.exe 3120 MicrosoftEdgeCPS.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
MicrosoftEdgeCPS.exepid process 1612 MicrosoftEdgeCPS.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 1952 wmic.exe Token: SeSecurityPrivilege 1952 wmic.exe Token: SeTakeOwnershipPrivilege 1952 wmic.exe Token: SeLoadDriverPrivilege 1952 wmic.exe Token: SeSystemProfilePrivilege 1952 wmic.exe Token: SeSystemtimePrivilege 1952 wmic.exe Token: SeProfSingleProcessPrivilege 1952 wmic.exe Token: SeIncBasePriorityPrivilege 1952 wmic.exe Token: SeCreatePagefilePrivilege 1952 wmic.exe Token: SeBackupPrivilege 1952 wmic.exe Token: SeRestorePrivilege 1952 wmic.exe Token: SeShutdownPrivilege 1952 wmic.exe Token: SeDebugPrivilege 1952 wmic.exe Token: SeSystemEnvironmentPrivilege 1952 wmic.exe Token: SeRemoteShutdownPrivilege 1952 wmic.exe Token: SeUndockPrivilege 1952 wmic.exe Token: SeManageVolumePrivilege 1952 wmic.exe Token: 33 1952 wmic.exe Token: 34 1952 wmic.exe Token: 35 1952 wmic.exe Token: 36 1952 wmic.exe Token: SeIncreaseQuotaPrivilege 1952 wmic.exe Token: SeSecurityPrivilege 1952 wmic.exe Token: SeTakeOwnershipPrivilege 1952 wmic.exe Token: SeLoadDriverPrivilege 1952 wmic.exe Token: SeSystemProfilePrivilege 1952 wmic.exe Token: SeSystemtimePrivilege 1952 wmic.exe Token: SeProfSingleProcessPrivilege 1952 wmic.exe Token: SeIncBasePriorityPrivilege 1952 wmic.exe Token: SeCreatePagefilePrivilege 1952 wmic.exe Token: SeBackupPrivilege 1952 wmic.exe Token: SeRestorePrivilege 1952 wmic.exe Token: SeShutdownPrivilege 1952 wmic.exe Token: SeDebugPrivilege 1952 wmic.exe Token: SeSystemEnvironmentPrivilege 1952 wmic.exe Token: SeRemoteShutdownPrivilege 1952 wmic.exe Token: SeUndockPrivilege 1952 wmic.exe Token: SeManageVolumePrivilege 1952 wmic.exe Token: 33 1952 wmic.exe Token: 34 1952 wmic.exe Token: 35 1952 wmic.exe Token: 36 1952 wmic.exe Token: SeIncreaseQuotaPrivilege 3492 wmic.exe Token: SeSecurityPrivilege 3492 wmic.exe Token: SeTakeOwnershipPrivilege 3492 wmic.exe Token: SeLoadDriverPrivilege 3492 wmic.exe Token: SeSystemProfilePrivilege 3492 wmic.exe Token: SeSystemtimePrivilege 3492 wmic.exe Token: SeProfSingleProcessPrivilege 3492 wmic.exe Token: SeIncBasePriorityPrivilege 3492 wmic.exe Token: SeCreatePagefilePrivilege 3492 wmic.exe Token: SeBackupPrivilege 3492 wmic.exe Token: SeRestorePrivilege 3492 wmic.exe Token: SeShutdownPrivilege 3492 wmic.exe Token: SeDebugPrivilege 3492 wmic.exe Token: SeSystemEnvironmentPrivilege 3492 wmic.exe Token: SeRemoteShutdownPrivilege 3492 wmic.exe Token: SeUndockPrivilege 3492 wmic.exe Token: SeManageVolumePrivilege 3492 wmic.exe Token: 33 3492 wmic.exe Token: 34 3492 wmic.exe Token: 35 3492 wmic.exe Token: 36 3492 wmic.exe Token: SeIncreaseQuotaPrivilege 3492 wmic.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MicrosoftEdgeCPS.exepid process 3548 MicrosoftEdgeCPS.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8343d0955b6e122e915e7c381d597f60eeb96b18c9069bc35276c04e0fe52448.bin.exeMicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exedescription pid process target process PID 732 wrote to memory of 3120 732 8343d0955b6e122e915e7c381d597f60eeb96b18c9069bc35276c04e0fe52448.bin.exe MicrosoftEdgeCPS.exe PID 732 wrote to memory of 3120 732 8343d0955b6e122e915e7c381d597f60eeb96b18c9069bc35276c04e0fe52448.bin.exe MicrosoftEdgeCPS.exe PID 732 wrote to memory of 3120 732 8343d0955b6e122e915e7c381d597f60eeb96b18c9069bc35276c04e0fe52448.bin.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 1952 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 1952 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 1952 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 3492 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 3492 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 3492 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 3468 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 3468 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 3468 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 4052 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 4052 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 4052 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 3156 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 3156 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 3156 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 2276 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 2276 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 2276 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 3912 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 3912 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 3912 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 1612 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 1612 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 1612 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 1612 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 1612 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 1612 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 1612 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 1612 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 1612 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 1612 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 1612 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 1612 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 2108 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 2108 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 2108 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 2108 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 2108 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 2108 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 2108 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 2108 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 2108 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 3548 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 3548 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 3548 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 3548 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 3548 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 3548 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 3548 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3120 wrote to memory of 3548 3120 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1612 wrote to memory of 3780 1612 MicrosoftEdgeCPS.exe WerFault.exe PID 1612 wrote to memory of 3780 1612 MicrosoftEdgeCPS.exe WerFault.exe PID 1612 wrote to memory of 3780 1612 MicrosoftEdgeCPS.exe WerFault.exe PID 1612 wrote to memory of 3780 1612 MicrosoftEdgeCPS.exe WerFault.exe PID 1612 wrote to memory of 3780 1612 MicrosoftEdgeCPS.exe WerFault.exe PID 3120 wrote to memory of 644 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 644 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 644 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 1904 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 1904 3120 MicrosoftEdgeCPS.exe wmic.exe PID 3120 wrote to memory of 1904 3120 MicrosoftEdgeCPS.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8343d0955b6e122e915e7c381d597f60eeb96b18c9069bc35276c04e0fe52448.bin.exe"C:\Users\Admin\AppData\Local\Temp\8343d0955b6e122e915e7c381d597f60eeb96b18c9069bc35276c04e0fe52448.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" /Node:localhost /Namespace:\\root\SecurityCenter2 path AntiVirusProduct get DisplayName /FORMAT:List3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" os get caption /FORMAT:List3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_VideoController get caption /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_NetworkAdapterConfiguration where IPEnabled=1 get IPAddress /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" LogicalDisk Where DriveType=4 get VolumeName /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='185.193.88.150' get StatusCode /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='185.193.88.150' get ResponseTime /FORMAT:List3⤵
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe4⤵
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe/scomma "C:\Users\Admin\AppData\Roaming\EdgeCP\1.log"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe/scomma "C:\Users\Admin\AppData\Roaming\EdgeCP\4.log"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='185.193.88.150' get StatusCode /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='185.193.88.150' get ResponseTime /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='185.193.88.150' get StatusCode /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='185.193.88.150' get ResponseTime /FORMAT:List3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\EdgeCP\1.logMD5
c899085ae52e1212260bd31f38dd7cad
SHA1482ebdfa75ac934e022670beea5258f08863abcb
SHA25620c8330e6a19bd31b379f102f9ede1fd315fc763dd1d805b310ade04860d69cf
SHA5123139ffb0e6c9ac312dd38aed58953b5249c8374529972553353e40bef982376b71f7a3551abd860f17443708d032c03feb2795860510a33df3abd35aebda155e
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeMD5
694aeb997cad16f5d2a82fe34447c2f5
SHA199151301e07d13301ce5a579d087b6a78389c38b
SHA2568343d0955b6e122e915e7c381d597f60eeb96b18c9069bc35276c04e0fe52448
SHA512f0979eea4e1b2141442d48f6b84b76d2dfae24f59df6b5e9446c4652e566415bc09e2a9d8ca5628fbfc7e260e5d2a5992023bcd5a13f980ebf204c2d80ff95ba
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeMD5
694aeb997cad16f5d2a82fe34447c2f5
SHA199151301e07d13301ce5a579d087b6a78389c38b
SHA2568343d0955b6e122e915e7c381d597f60eeb96b18c9069bc35276c04e0fe52448
SHA512f0979eea4e1b2141442d48f6b84b76d2dfae24f59df6b5e9446c4652e566415bc09e2a9d8ca5628fbfc7e260e5d2a5992023bcd5a13f980ebf204c2d80ff95ba
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeMD5
694aeb997cad16f5d2a82fe34447c2f5
SHA199151301e07d13301ce5a579d087b6a78389c38b
SHA2568343d0955b6e122e915e7c381d597f60eeb96b18c9069bc35276c04e0fe52448
SHA512f0979eea4e1b2141442d48f6b84b76d2dfae24f59df6b5e9446c4652e566415bc09e2a9d8ca5628fbfc7e260e5d2a5992023bcd5a13f980ebf204c2d80ff95ba
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeMD5
694aeb997cad16f5d2a82fe34447c2f5
SHA199151301e07d13301ce5a579d087b6a78389c38b
SHA2568343d0955b6e122e915e7c381d597f60eeb96b18c9069bc35276c04e0fe52448
SHA512f0979eea4e1b2141442d48f6b84b76d2dfae24f59df6b5e9446c4652e566415bc09e2a9d8ca5628fbfc7e260e5d2a5992023bcd5a13f980ebf204c2d80ff95ba
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeMD5
694aeb997cad16f5d2a82fe34447c2f5
SHA199151301e07d13301ce5a579d087b6a78389c38b
SHA2568343d0955b6e122e915e7c381d597f60eeb96b18c9069bc35276c04e0fe52448
SHA512f0979eea4e1b2141442d48f6b84b76d2dfae24f59df6b5e9446c4652e566415bc09e2a9d8ca5628fbfc7e260e5d2a5992023bcd5a13f980ebf204c2d80ff95ba
-
memory/0-67-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/0-60-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/0-57-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/0-56-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/0-43-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/0-42-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/0-41-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/0-66-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/644-64-0x0000000000000000-mapping.dmp
-
memory/848-68-0x0000000000000000-mapping.dmp
-
memory/1612-13-0x00000000004043A8-mapping.dmp
-
memory/1612-37-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/1612-20-0x0000000002D80000-0x0000000002DF8000-memory.dmpFilesize
480KB
-
memory/1612-21-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1612-12-0x0000000000400000-0x0000000002BE9000-memory.dmpFilesize
39.9MB
-
memory/1612-15-0x0000000000400000-0x0000000002BE9000-memory.dmpFilesize
39.9MB
-
memory/1612-16-0x00000000031B0000-0x00000000031B1000-memory.dmpFilesize
4KB
-
memory/1612-36-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/1612-38-0x00000000005C0000-0x0000000000700000-memory.dmpFilesize
1.2MB
-
memory/1904-65-0x0000000000000000-mapping.dmp
-
memory/1952-5-0x0000000000000000-mapping.dmp
-
memory/2108-17-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/2108-18-0x00000000004466F4-mapping.dmp
-
memory/2108-22-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/2276-10-0x0000000000000000-mapping.dmp
-
memory/3120-2-0x0000000000000000-mapping.dmp
-
memory/3156-9-0x0000000000000000-mapping.dmp
-
memory/3468-7-0x0000000000000000-mapping.dmp
-
memory/3492-6-0x0000000000000000-mapping.dmp
-
memory/3548-25-0x0000000000401074-mapping.dmp
-
memory/3548-29-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/3548-24-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/3780-40-0x000001525D000000-0x000001525D0C9000-memory.dmpFilesize
804KB
-
memory/3780-39-0x000001525CD70000-0x000001525CD71000-memory.dmpFilesize
4KB
-
memory/3780-35-0x0000000000000000-mapping.dmp
-
memory/3912-11-0x0000000000000000-mapping.dmp
-
memory/3940-69-0x0000000000000000-mapping.dmp
-
memory/4052-8-0x0000000000000000-mapping.dmp