Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
08-03-2021 11:20
Static task
static1
Behavioral task
behavioral1
Sample
9526e9792bed9efe4ed6101deff93b649701cf0f77b024567b5c0540b4b3c7bf.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
9526e9792bed9efe4ed6101deff93b649701cf0f77b024567b5c0540b4b3c7bf.exe
Resource
win10v20201028
General
-
Target
9526e9792bed9efe4ed6101deff93b649701cf0f77b024567b5c0540b4b3c7bf.exe
-
Size
1.4MB
-
MD5
f3da87fb27befc3df1eec757587fe93b
-
SHA1
798f0f6dba708beb6aee86469e5084b08d2e2714
-
SHA256
9526e9792bed9efe4ed6101deff93b649701cf0f77b024567b5c0540b4b3c7bf
-
SHA512
51d0a44359eeacb8344955099dce9fec20e46ddf509aea1036503eb0e278fbac363d797fb8745ea3b8ddd5e6f5c3c81f496e0354a10603e80c3028492bc7adaa
Malware Config
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
DiamondFox payload 2 IoCs
Detects DiamondFox payload in file/memory.
Processes:
resource yara_rule behavioral2/memory/4696-3-0x00000000001C0000-0x00000000001F3000-memory.dmp diamondfox behavioral2/memory/4696-4-0x0000000000400000-0x0000000000435000-memory.dmp diamondfox -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral2/memory/4008-22-0x0000000000400000-0x000000000047C000-memory.dmp WebBrowserPassView behavioral2/memory/4008-23-0x00000000004466F4-mapping.dmp WebBrowserPassView behavioral2/memory/4008-25-0x0000000000400000-0x000000000047C000-memory.dmp WebBrowserPassView -
Nirsoft 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4008-22-0x0000000000400000-0x000000000047C000-memory.dmp Nirsoft behavioral2/memory/4008-23-0x00000000004466F4-mapping.dmp Nirsoft behavioral2/memory/4008-25-0x0000000000400000-0x000000000047C000-memory.dmp Nirsoft -
Executes dropped EXE 4 IoCs
Processes:
MicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exepid process 3232 MicrosoftEdgeCPS.exe 3916 MicrosoftEdgeCPS.exe 4008 MicrosoftEdgeCPS.exe 2900 MicrosoftEdgeCPS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 17 IoCs
Processes:
MicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exedescription pid process target process PID 3232 set thread context of 3916 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 set thread context of 4008 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 set thread context of 2900 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3916 set thread context of 196 3916 MicrosoftEdgeCPS.exe WerFault.exe PID 3232 set thread context of 0 3232 MicrosoftEdgeCPS.exe PID 3232 set thread context of 0 3232 MicrosoftEdgeCPS.exe PID 3232 set thread context of 0 3232 MicrosoftEdgeCPS.exe PID 3232 set thread context of 0 3232 MicrosoftEdgeCPS.exe PID 3232 set thread context of 0 3232 MicrosoftEdgeCPS.exe PID 3232 set thread context of 0 3232 MicrosoftEdgeCPS.exe PID 3232 set thread context of 0 3232 MicrosoftEdgeCPS.exe PID 3232 set thread context of 0 3232 MicrosoftEdgeCPS.exe PID 3232 set thread context of 0 3232 MicrosoftEdgeCPS.exe PID 3232 set thread context of 0 3232 MicrosoftEdgeCPS.exe PID 3232 set thread context of 0 3232 MicrosoftEdgeCPS.exe PID 3232 set thread context of 0 3232 MicrosoftEdgeCPS.exe PID 3232 set thread context of 0 3232 MicrosoftEdgeCPS.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
MicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exepid process 3232 MicrosoftEdgeCPS.exe 3232 MicrosoftEdgeCPS.exe 4008 MicrosoftEdgeCPS.exe 4008 MicrosoftEdgeCPS.exe 4008 MicrosoftEdgeCPS.exe 4008 MicrosoftEdgeCPS.exe 3232 MicrosoftEdgeCPS.exe 3232 MicrosoftEdgeCPS.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
MicrosoftEdgeCPS.exepid process 3916 MicrosoftEdgeCPS.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 3096 wmic.exe Token: SeSecurityPrivilege 3096 wmic.exe Token: SeTakeOwnershipPrivilege 3096 wmic.exe Token: SeLoadDriverPrivilege 3096 wmic.exe Token: SeSystemProfilePrivilege 3096 wmic.exe Token: SeSystemtimePrivilege 3096 wmic.exe Token: SeProfSingleProcessPrivilege 3096 wmic.exe Token: SeIncBasePriorityPrivilege 3096 wmic.exe Token: SeCreatePagefilePrivilege 3096 wmic.exe Token: SeBackupPrivilege 3096 wmic.exe Token: SeRestorePrivilege 3096 wmic.exe Token: SeShutdownPrivilege 3096 wmic.exe Token: SeDebugPrivilege 3096 wmic.exe Token: SeSystemEnvironmentPrivilege 3096 wmic.exe Token: SeRemoteShutdownPrivilege 3096 wmic.exe Token: SeUndockPrivilege 3096 wmic.exe Token: SeManageVolumePrivilege 3096 wmic.exe Token: 33 3096 wmic.exe Token: 34 3096 wmic.exe Token: 35 3096 wmic.exe Token: 36 3096 wmic.exe Token: SeIncreaseQuotaPrivilege 3096 wmic.exe Token: SeSecurityPrivilege 3096 wmic.exe Token: SeTakeOwnershipPrivilege 3096 wmic.exe Token: SeLoadDriverPrivilege 3096 wmic.exe Token: SeSystemProfilePrivilege 3096 wmic.exe Token: SeSystemtimePrivilege 3096 wmic.exe Token: SeProfSingleProcessPrivilege 3096 wmic.exe Token: SeIncBasePriorityPrivilege 3096 wmic.exe Token: SeCreatePagefilePrivilege 3096 wmic.exe Token: SeBackupPrivilege 3096 wmic.exe Token: SeRestorePrivilege 3096 wmic.exe Token: SeShutdownPrivilege 3096 wmic.exe Token: SeDebugPrivilege 3096 wmic.exe Token: SeSystemEnvironmentPrivilege 3096 wmic.exe Token: SeRemoteShutdownPrivilege 3096 wmic.exe Token: SeUndockPrivilege 3096 wmic.exe Token: SeManageVolumePrivilege 3096 wmic.exe Token: 33 3096 wmic.exe Token: 34 3096 wmic.exe Token: 35 3096 wmic.exe Token: 36 3096 wmic.exe Token: SeIncreaseQuotaPrivilege 848 wmic.exe Token: SeSecurityPrivilege 848 wmic.exe Token: SeTakeOwnershipPrivilege 848 wmic.exe Token: SeLoadDriverPrivilege 848 wmic.exe Token: SeSystemProfilePrivilege 848 wmic.exe Token: SeSystemtimePrivilege 848 wmic.exe Token: SeProfSingleProcessPrivilege 848 wmic.exe Token: SeIncBasePriorityPrivilege 848 wmic.exe Token: SeCreatePagefilePrivilege 848 wmic.exe Token: SeBackupPrivilege 848 wmic.exe Token: SeRestorePrivilege 848 wmic.exe Token: SeShutdownPrivilege 848 wmic.exe Token: SeDebugPrivilege 848 wmic.exe Token: SeSystemEnvironmentPrivilege 848 wmic.exe Token: SeRemoteShutdownPrivilege 848 wmic.exe Token: SeUndockPrivilege 848 wmic.exe Token: SeManageVolumePrivilege 848 wmic.exe Token: 33 848 wmic.exe Token: 34 848 wmic.exe Token: 35 848 wmic.exe Token: 36 848 wmic.exe Token: SeIncreaseQuotaPrivilege 848 wmic.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
MicrosoftEdgeCPS.exepid process 2900 MicrosoftEdgeCPS.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
9526e9792bed9efe4ed6101deff93b649701cf0f77b024567b5c0540b4b3c7bf.exeMicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exedescription pid process target process PID 4696 wrote to memory of 3232 4696 9526e9792bed9efe4ed6101deff93b649701cf0f77b024567b5c0540b4b3c7bf.exe MicrosoftEdgeCPS.exe PID 4696 wrote to memory of 3232 4696 9526e9792bed9efe4ed6101deff93b649701cf0f77b024567b5c0540b4b3c7bf.exe MicrosoftEdgeCPS.exe PID 4696 wrote to memory of 3232 4696 9526e9792bed9efe4ed6101deff93b649701cf0f77b024567b5c0540b4b3c7bf.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 3096 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 3096 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 3096 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 848 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 848 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 848 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 1164 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 1164 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 1164 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 1584 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 1584 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 1584 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 1920 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 1920 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 1920 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 2360 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 2360 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 2360 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 2784 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 2784 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 2784 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 3916 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 3916 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 3916 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 3916 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 3916 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 3916 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 3916 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 3916 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 3916 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 3916 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 3916 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 3916 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 4008 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 4008 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 4008 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 4008 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 4008 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 4008 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 4008 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 4008 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 4008 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 2900 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 2900 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 2900 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 2900 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 2900 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 2900 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 2900 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3232 wrote to memory of 2900 3232 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 3916 wrote to memory of 196 3916 MicrosoftEdgeCPS.exe WerFault.exe PID 3916 wrote to memory of 196 3916 MicrosoftEdgeCPS.exe WerFault.exe PID 3916 wrote to memory of 196 3916 MicrosoftEdgeCPS.exe WerFault.exe PID 3916 wrote to memory of 196 3916 MicrosoftEdgeCPS.exe WerFault.exe PID 3916 wrote to memory of 196 3916 MicrosoftEdgeCPS.exe WerFault.exe PID 3232 wrote to memory of 2224 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 2224 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 2224 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 3892 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 3892 3232 MicrosoftEdgeCPS.exe wmic.exe PID 3232 wrote to memory of 3892 3232 MicrosoftEdgeCPS.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9526e9792bed9efe4ed6101deff93b649701cf0f77b024567b5c0540b4b3c7bf.exe"C:\Users\Admin\AppData\Local\Temp\9526e9792bed9efe4ed6101deff93b649701cf0f77b024567b5c0540b4b3c7bf.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" /Node:localhost /Namespace:\\root\SecurityCenter2 path AntiVirusProduct get DisplayName /FORMAT:List3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" os get caption /FORMAT:List3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_VideoController get caption /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_NetworkAdapterConfiguration where IPEnabled=1 get IPAddress /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" LogicalDisk Where DriveType=4 get VolumeName /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='185.193.88.150' get StatusCode /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='185.193.88.150' get ResponseTime /FORMAT:List3⤵
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe4⤵
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe/scomma "C:\Users\Admin\AppData\Roaming\EdgeCP\1.log"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe/scomma "C:\Users\Admin\AppData\Roaming\EdgeCP\4.log"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='185.193.88.150' get StatusCode /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='185.193.88.150' get ResponseTime /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='185.193.88.150' get StatusCode /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='185.193.88.150' get ResponseTime /FORMAT:List3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\EdgeCP\1.logMD5
c899085ae52e1212260bd31f38dd7cad
SHA1482ebdfa75ac934e022670beea5258f08863abcb
SHA25620c8330e6a19bd31b379f102f9ede1fd315fc763dd1d805b310ade04860d69cf
SHA5123139ffb0e6c9ac312dd38aed58953b5249c8374529972553353e40bef982376b71f7a3551abd860f17443708d032c03feb2795860510a33df3abd35aebda155e
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeMD5
f3da87fb27befc3df1eec757587fe93b
SHA1798f0f6dba708beb6aee86469e5084b08d2e2714
SHA2569526e9792bed9efe4ed6101deff93b649701cf0f77b024567b5c0540b4b3c7bf
SHA51251d0a44359eeacb8344955099dce9fec20e46ddf509aea1036503eb0e278fbac363d797fb8745ea3b8ddd5e6f5c3c81f496e0354a10603e80c3028492bc7adaa
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeMD5
f3da87fb27befc3df1eec757587fe93b
SHA1798f0f6dba708beb6aee86469e5084b08d2e2714
SHA2569526e9792bed9efe4ed6101deff93b649701cf0f77b024567b5c0540b4b3c7bf
SHA51251d0a44359eeacb8344955099dce9fec20e46ddf509aea1036503eb0e278fbac363d797fb8745ea3b8ddd5e6f5c3c81f496e0354a10603e80c3028492bc7adaa
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeMD5
f3da87fb27befc3df1eec757587fe93b
SHA1798f0f6dba708beb6aee86469e5084b08d2e2714
SHA2569526e9792bed9efe4ed6101deff93b649701cf0f77b024567b5c0540b4b3c7bf
SHA51251d0a44359eeacb8344955099dce9fec20e46ddf509aea1036503eb0e278fbac363d797fb8745ea3b8ddd5e6f5c3c81f496e0354a10603e80c3028492bc7adaa
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeMD5
f3da87fb27befc3df1eec757587fe93b
SHA1798f0f6dba708beb6aee86469e5084b08d2e2714
SHA2569526e9792bed9efe4ed6101deff93b649701cf0f77b024567b5c0540b4b3c7bf
SHA51251d0a44359eeacb8344955099dce9fec20e46ddf509aea1036503eb0e278fbac363d797fb8745ea3b8ddd5e6f5c3c81f496e0354a10603e80c3028492bc7adaa
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeMD5
f3da87fb27befc3df1eec757587fe93b
SHA1798f0f6dba708beb6aee86469e5084b08d2e2714
SHA2569526e9792bed9efe4ed6101deff93b649701cf0f77b024567b5c0540b4b3c7bf
SHA51251d0a44359eeacb8344955099dce9fec20e46ddf509aea1036503eb0e278fbac363d797fb8745ea3b8ddd5e6f5c3c81f496e0354a10603e80c3028492bc7adaa
-
memory/0-48-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/0-63-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/0-73-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/0-72-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/0-62-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/0-47-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/0-51-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/0-50-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/0-49-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/196-45-0x0000020DA1210000-0x0000020DA1211000-memory.dmpFilesize
4KB
-
memory/196-46-0x0000020DA1480000-0x0000020DA1549000-memory.dmpFilesize
804KB
-
memory/196-41-0x0000000000000000-mapping.dmp
-
memory/848-12-0x0000000000000000-mapping.dmp
-
memory/1164-13-0x0000000000000000-mapping.dmp
-
memory/1584-14-0x0000000000000000-mapping.dmp
-
memory/1920-15-0x0000000000000000-mapping.dmp
-
memory/2224-70-0x0000000000000000-mapping.dmp
-
memory/2360-16-0x0000000000000000-mapping.dmp
-
memory/2784-17-0x0000000000000000-mapping.dmp
-
memory/2900-30-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/2900-31-0x0000000000401074-mapping.dmp
-
memory/2900-35-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/3096-11-0x0000000000000000-mapping.dmp
-
memory/3232-5-0x0000000000000000-mapping.dmp
-
memory/3232-8-0x0000000000C80000-0x0000000000C81000-memory.dmpFilesize
4KB
-
memory/3436-75-0x0000000000000000-mapping.dmp
-
memory/3892-71-0x0000000000000000-mapping.dmp
-
memory/3916-21-0x0000000000400000-0x0000000002BE9000-memory.dmpFilesize
39.9MB
-
memory/3916-43-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/3916-27-0x0000000003040000-0x00000000030B8000-memory.dmpFilesize
480KB
-
memory/3916-28-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/3916-19-0x00000000004043A8-mapping.dmp
-
memory/3916-18-0x0000000000400000-0x0000000002BE9000-memory.dmpFilesize
39.9MB
-
memory/3916-26-0x00000000030E0000-0x00000000030E1000-memory.dmpFilesize
4KB
-
memory/3916-42-0x0000000004940000-0x0000000004941000-memory.dmpFilesize
4KB
-
memory/3916-44-0x0000000000640000-0x0000000000780000-memory.dmpFilesize
1.2MB
-
memory/4008-25-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/4008-23-0x00000000004466F4-mapping.dmp
-
memory/4008-22-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/4696-2-0x0000000000D10000-0x0000000000D11000-memory.dmpFilesize
4KB
-
memory/4696-4-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/4696-3-0x00000000001C0000-0x00000000001F3000-memory.dmpFilesize
204KB
-
memory/4888-74-0x0000000000000000-mapping.dmp