Analysis
-
max time kernel
83s -
max time network
140s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
07-04-2021 11:27
Static task
static1
Behavioral task
behavioral1
Sample
450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0.bin.exe
Resource
win10v20201028
General
-
Target
450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0.bin.exe
-
Size
388KB
-
MD5
857ccd0b42e24d10df82a3594bf0b514
-
SHA1
8cce4d26a66b47029ead46e5730227c193ca8e1b
-
SHA256
450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0
-
SHA512
9c20a3fa74138634bea975b070058f538ee8f1b05e6aaad92982c87c10f9d597e232ed142bd7d56a774e99dc465a4233afa070480d4609c851a646169c4b4ba2
Malware Config
Signatures
-
DiamondFox
DiamondFox is a multipurpose botnet with many capabilities.
-
DiamondFox payload 3 IoCs
Detects DiamondFox payload in file/memory.
Processes:
resource yara_rule behavioral1/memory/1784-6-0x0000000000280000-0x00000000002B3000-memory.dmp diamondfox behavioral1/memory/1784-8-0x0000000000400000-0x0000000000435000-memory.dmp diamondfox behavioral1/memory/1448-19-0x0000000000400000-0x0000000000435000-memory.dmp diamondfox -
NirSoft WebBrowserPassView 3 IoCs
Password recovery tool for various web browsers
Processes:
resource yara_rule behavioral1/memory/920-44-0x0000000000400000-0x000000000047C000-memory.dmp WebBrowserPassView behavioral1/memory/920-45-0x00000000004466F4-mapping.dmp WebBrowserPassView behavioral1/memory/920-51-0x0000000000400000-0x000000000047C000-memory.dmp WebBrowserPassView -
Nirsoft 3 IoCs
Processes:
resource yara_rule behavioral1/memory/920-44-0x0000000000400000-0x000000000047C000-memory.dmp Nirsoft behavioral1/memory/920-45-0x00000000004466F4-mapping.dmp Nirsoft behavioral1/memory/920-51-0x0000000000400000-0x000000000047C000-memory.dmp Nirsoft -
Executes dropped EXE 3 IoCs
Processes:
MicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exepid process 1448 MicrosoftEdgeCPS.exe 1304 MicrosoftEdgeCPS.exe 920 MicrosoftEdgeCPS.exe -
Loads dropped DLL 3 IoCs
Processes:
450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0.bin.exeMicrosoftEdgeCPS.exepid process 1784 450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0.bin.exe 1784 450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0.bin.exe 1448 MicrosoftEdgeCPS.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 17 IoCs
Processes:
MicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exedescription pid process target process PID 1448 set thread context of 1304 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 set thread context of 920 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1304 set thread context of 884 1304 MicrosoftEdgeCPS.exe WerFault.exe PID 1448 set thread context of 0 1448 MicrosoftEdgeCPS.exe PID 1448 set thread context of 0 1448 MicrosoftEdgeCPS.exe PID 1448 set thread context of 0 1448 MicrosoftEdgeCPS.exe PID 1448 set thread context of 0 1448 MicrosoftEdgeCPS.exe PID 1448 set thread context of 0 1448 MicrosoftEdgeCPS.exe PID 1448 set thread context of 0 1448 MicrosoftEdgeCPS.exe PID 1448 set thread context of 0 1448 MicrosoftEdgeCPS.exe PID 1448 set thread context of 0 1448 MicrosoftEdgeCPS.exe PID 1448 set thread context of 0 1448 MicrosoftEdgeCPS.exe PID 1448 set thread context of 0 1448 MicrosoftEdgeCPS.exe PID 1448 set thread context of 0 1448 MicrosoftEdgeCPS.exe PID 1448 set thread context of 0 1448 MicrosoftEdgeCPS.exe PID 1448 set thread context of 0 1448 MicrosoftEdgeCPS.exe PID 1448 set thread context of 0 1448 MicrosoftEdgeCPS.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
MicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exepid process 1448 MicrosoftEdgeCPS.exe 920 MicrosoftEdgeCPS.exe 920 MicrosoftEdgeCPS.exe 1448 MicrosoftEdgeCPS.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
MicrosoftEdgeCPS.exepid process 1304 MicrosoftEdgeCPS.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
wmic.exewmic.exedescription pid process Token: SeIncreaseQuotaPrivilege 440 wmic.exe Token: SeSecurityPrivilege 440 wmic.exe Token: SeTakeOwnershipPrivilege 440 wmic.exe Token: SeLoadDriverPrivilege 440 wmic.exe Token: SeSystemProfilePrivilege 440 wmic.exe Token: SeSystemtimePrivilege 440 wmic.exe Token: SeProfSingleProcessPrivilege 440 wmic.exe Token: SeIncBasePriorityPrivilege 440 wmic.exe Token: SeCreatePagefilePrivilege 440 wmic.exe Token: SeBackupPrivilege 440 wmic.exe Token: SeRestorePrivilege 440 wmic.exe Token: SeShutdownPrivilege 440 wmic.exe Token: SeDebugPrivilege 440 wmic.exe Token: SeSystemEnvironmentPrivilege 440 wmic.exe Token: SeRemoteShutdownPrivilege 440 wmic.exe Token: SeUndockPrivilege 440 wmic.exe Token: SeManageVolumePrivilege 440 wmic.exe Token: 33 440 wmic.exe Token: 34 440 wmic.exe Token: 35 440 wmic.exe Token: SeIncreaseQuotaPrivilege 440 wmic.exe Token: SeSecurityPrivilege 440 wmic.exe Token: SeTakeOwnershipPrivilege 440 wmic.exe Token: SeLoadDriverPrivilege 440 wmic.exe Token: SeSystemProfilePrivilege 440 wmic.exe Token: SeSystemtimePrivilege 440 wmic.exe Token: SeProfSingleProcessPrivilege 440 wmic.exe Token: SeIncBasePriorityPrivilege 440 wmic.exe Token: SeCreatePagefilePrivilege 440 wmic.exe Token: SeBackupPrivilege 440 wmic.exe Token: SeRestorePrivilege 440 wmic.exe Token: SeShutdownPrivilege 440 wmic.exe Token: SeDebugPrivilege 440 wmic.exe Token: SeSystemEnvironmentPrivilege 440 wmic.exe Token: SeRemoteShutdownPrivilege 440 wmic.exe Token: SeUndockPrivilege 440 wmic.exe Token: SeManageVolumePrivilege 440 wmic.exe Token: 33 440 wmic.exe Token: 34 440 wmic.exe Token: 35 440 wmic.exe Token: SeIncreaseQuotaPrivilege 1128 wmic.exe Token: SeSecurityPrivilege 1128 wmic.exe Token: SeTakeOwnershipPrivilege 1128 wmic.exe Token: SeLoadDriverPrivilege 1128 wmic.exe Token: SeSystemProfilePrivilege 1128 wmic.exe Token: SeSystemtimePrivilege 1128 wmic.exe Token: SeProfSingleProcessPrivilege 1128 wmic.exe Token: SeIncBasePriorityPrivilege 1128 wmic.exe Token: SeCreatePagefilePrivilege 1128 wmic.exe Token: SeBackupPrivilege 1128 wmic.exe Token: SeRestorePrivilege 1128 wmic.exe Token: SeShutdownPrivilege 1128 wmic.exe Token: SeDebugPrivilege 1128 wmic.exe Token: SeSystemEnvironmentPrivilege 1128 wmic.exe Token: SeRemoteShutdownPrivilege 1128 wmic.exe Token: SeUndockPrivilege 1128 wmic.exe Token: SeManageVolumePrivilege 1128 wmic.exe Token: 33 1128 wmic.exe Token: 34 1128 wmic.exe Token: 35 1128 wmic.exe Token: SeIncreaseQuotaPrivilege 1128 wmic.exe Token: SeSecurityPrivilege 1128 wmic.exe Token: SeTakeOwnershipPrivilege 1128 wmic.exe Token: SeLoadDriverPrivilege 1128 wmic.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0.bin.exeMicrosoftEdgeCPS.exeMicrosoftEdgeCPS.exedescription pid process target process PID 1784 wrote to memory of 1448 1784 450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0.bin.exe MicrosoftEdgeCPS.exe PID 1784 wrote to memory of 1448 1784 450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0.bin.exe MicrosoftEdgeCPS.exe PID 1784 wrote to memory of 1448 1784 450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0.bin.exe MicrosoftEdgeCPS.exe PID 1784 wrote to memory of 1448 1784 450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0.bin.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 440 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 440 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 440 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 440 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 1128 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 1128 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 1128 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 1128 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 884 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 884 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 884 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 884 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 1596 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 1596 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 1596 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 1596 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 1260 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 1260 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 1260 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 1260 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 620 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 620 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 620 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 620 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 1900 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 1900 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 1900 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 1900 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 1304 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 1304 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 1304 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 1304 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 1304 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 1304 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 1304 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 1304 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 1304 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 1304 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 1304 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 1304 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 1304 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 920 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 920 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 920 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 920 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 920 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 920 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 920 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 920 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 920 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1448 wrote to memory of 920 1448 MicrosoftEdgeCPS.exe MicrosoftEdgeCPS.exe PID 1304 wrote to memory of 884 1304 MicrosoftEdgeCPS.exe WerFault.exe PID 1304 wrote to memory of 884 1304 MicrosoftEdgeCPS.exe WerFault.exe PID 1304 wrote to memory of 884 1304 MicrosoftEdgeCPS.exe WerFault.exe PID 1304 wrote to memory of 884 1304 MicrosoftEdgeCPS.exe WerFault.exe PID 1304 wrote to memory of 884 1304 MicrosoftEdgeCPS.exe WerFault.exe PID 1304 wrote to memory of 884 1304 MicrosoftEdgeCPS.exe WerFault.exe PID 1304 wrote to memory of 884 1304 MicrosoftEdgeCPS.exe WerFault.exe PID 1448 wrote to memory of 1676 1448 MicrosoftEdgeCPS.exe wmic.exe PID 1448 wrote to memory of 1676 1448 MicrosoftEdgeCPS.exe wmic.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0.bin.exe"C:\Users\Admin\AppData\Local\Temp\450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0.bin.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" /Node:localhost /Namespace:\\root\SecurityCenter2 path AntiVirusProduct get DisplayName /FORMAT:List3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" os get caption /FORMAT:List3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_VideoController get caption /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_NetworkAdapterConfiguration where IPEnabled=1 get IPAddress /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" LogicalDisk Where DriveType=4 get VolumeName /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='185.193.88.150' get StatusCode /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='185.193.88.150' get ResponseTime /FORMAT:List3⤵
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe4⤵
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exe/scomma "C:\Users\Admin\AppData\Roaming\EdgeCP\1.log"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='185.193.88.150' get StatusCode /FORMAT:List3⤵
-
C:\Windows\SysWOW64\Wbem\wmic.exe"wmic" path win32_PingStatus where address='185.193.88.150' get ResponseTime /FORMAT:List3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\EdgeCP\1.logMD5
4f7d90f045ae07792fb8d76bce925854
SHA1c39b2866368f2c88c1865aa5577792bd2fb8bfe5
SHA256df74b997137fec63589828cafa9df9bfe272b330ffb8743fa4db79096a0fdc34
SHA5124ce48987acf465b7064d0162449eaf929b1e80dc760fe2da72e2841754a34536be5b2c17ade17d58e76c31bc9fdd6540820191395b9399287aabf4007274ae71
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeMD5
857ccd0b42e24d10df82a3594bf0b514
SHA18cce4d26a66b47029ead46e5730227c193ca8e1b
SHA256450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0
SHA5129c20a3fa74138634bea975b070058f538ee8f1b05e6aaad92982c87c10f9d597e232ed142bd7d56a774e99dc465a4233afa070480d4609c851a646169c4b4ba2
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeMD5
857ccd0b42e24d10df82a3594bf0b514
SHA18cce4d26a66b47029ead46e5730227c193ca8e1b
SHA256450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0
SHA5129c20a3fa74138634bea975b070058f538ee8f1b05e6aaad92982c87c10f9d597e232ed142bd7d56a774e99dc465a4233afa070480d4609c851a646169c4b4ba2
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeMD5
857ccd0b42e24d10df82a3594bf0b514
SHA18cce4d26a66b47029ead46e5730227c193ca8e1b
SHA256450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0
SHA5129c20a3fa74138634bea975b070058f538ee8f1b05e6aaad92982c87c10f9d597e232ed142bd7d56a774e99dc465a4233afa070480d4609c851a646169c4b4ba2
-
C:\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeMD5
857ccd0b42e24d10df82a3594bf0b514
SHA18cce4d26a66b47029ead46e5730227c193ca8e1b
SHA256450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0
SHA5129c20a3fa74138634bea975b070058f538ee8f1b05e6aaad92982c87c10f9d597e232ed142bd7d56a774e99dc465a4233afa070480d4609c851a646169c4b4ba2
-
\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeMD5
857ccd0b42e24d10df82a3594bf0b514
SHA18cce4d26a66b47029ead46e5730227c193ca8e1b
SHA256450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0
SHA5129c20a3fa74138634bea975b070058f538ee8f1b05e6aaad92982c87c10f9d597e232ed142bd7d56a774e99dc465a4233afa070480d4609c851a646169c4b4ba2
-
\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeMD5
857ccd0b42e24d10df82a3594bf0b514
SHA18cce4d26a66b47029ead46e5730227c193ca8e1b
SHA256450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0
SHA5129c20a3fa74138634bea975b070058f538ee8f1b05e6aaad92982c87c10f9d597e232ed142bd7d56a774e99dc465a4233afa070480d4609c851a646169c4b4ba2
-
\Users\Admin\AppData\Roaming\EdgeCP\MicrosoftEdgeCPS.exeMD5
857ccd0b42e24d10df82a3594bf0b514
SHA18cce4d26a66b47029ead46e5730227c193ca8e1b
SHA256450de76cc856f5cafae331a4f665cbab1edec731c6c3512e796cd82d4683c8f0
SHA5129c20a3fa74138634bea975b070058f538ee8f1b05e6aaad92982c87c10f9d597e232ed142bd7d56a774e99dc465a4233afa070480d4609c851a646169c4b4ba2
-
memory/0-69-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/0-71-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/0-95-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/0-96-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/0-68-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/0-87-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/0-88-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/0-85-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/0-70-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/0-72-0x0000000000400000-0x0000000000455000-memory.dmpFilesize
340KB
-
memory/0-73-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/0-79-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/0-75-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/0-76-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/0-77-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/440-32-0x0000000000000000-mapping.dmp
-
memory/620-37-0x0000000000000000-mapping.dmp
-
memory/884-64-0x000007FEFBA51000-0x000007FEFBA53000-memory.dmpFilesize
8KB
-
memory/884-34-0x0000000000000000-mapping.dmp
-
memory/884-65-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/884-63-0x0000000000000000-mapping.dmp
-
memory/884-66-0x0000000001C40000-0x0000000001D09000-memory.dmpFilesize
804KB
-
memory/920-51-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/920-45-0x00000000004466F4-mapping.dmp
-
memory/920-44-0x0000000000400000-0x000000000047C000-memory.dmpFilesize
496KB
-
memory/1068-94-0x0000000000000000-mapping.dmp
-
memory/1128-33-0x0000000000000000-mapping.dmp
-
memory/1260-36-0x0000000000000000-mapping.dmp
-
memory/1304-40-0x00000000004043A8-mapping.dmp
-
memory/1304-60-0x0000000000400000-0x000000000044D000-memory.dmpFilesize
308KB
-
memory/1304-61-0x00000000006A0000-0x00000000007E0000-memory.dmpFilesize
1.2MB
-
memory/1304-58-0x0000000010000000-0x0000000010089000-memory.dmpFilesize
548KB
-
memory/1304-49-0x0000000000400000-0x0000000002BE9000-memory.dmpFilesize
39.9MB
-
memory/1304-53-0x0000000002C60000-0x0000000002C61000-memory.dmpFilesize
4KB
-
memory/1304-52-0x0000000000400000-0x000000000047B000-memory.dmpFilesize
492KB
-
memory/1304-39-0x0000000000400000-0x0000000002BE9000-memory.dmpFilesize
39.9MB
-
memory/1304-50-0x0000000000220000-0x0000000000298000-memory.dmpFilesize
480KB
-
memory/1304-42-0x0000000000400000-0x0000000002BE9000-memory.dmpFilesize
39.9MB
-
memory/1304-43-0x0000000002F90000-0x0000000002FA1000-memory.dmpFilesize
68KB
-
memory/1448-19-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1448-13-0x0000000003000000-0x0000000003011000-memory.dmpFilesize
68KB
-
memory/1448-11-0x0000000000000000-mapping.dmp
-
memory/1580-25-0x000007FEF7510000-0x000007FEF778A000-memory.dmpFilesize
2.5MB
-
memory/1596-35-0x0000000000000000-mapping.dmp
-
memory/1676-93-0x0000000000000000-mapping.dmp
-
memory/1784-5-0x0000000000400000-0x0000000000857000-memory.dmpFilesize
4.3MB
-
memory/1784-6-0x0000000000280000-0x00000000002B3000-memory.dmpFilesize
204KB
-
memory/1784-7-0x00000000760D1000-0x00000000760D3000-memory.dmpFilesize
8KB
-
memory/1784-4-0x0000000002F50000-0x0000000002F61000-memory.dmpFilesize
68KB
-
memory/1784-2-0x0000000002E10000-0x0000000002E21000-memory.dmpFilesize
68KB
-
memory/1784-3-0x0000000000220000-0x0000000000280000-memory.dmpFilesize
384KB
-
memory/1784-8-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/1900-38-0x0000000000000000-mapping.dmp