Id: AVR:OOB[0xAB]+0x5 microsoftedgecp.exe!WININET.dll!CHttpHeaderParser::ParseStatusLine CBA208 Description: Access violation while reading memory at 0x6989000; 0x5 bytes beyond a 0xAB byte memory block at 0x6988F50 Process binary: microsoftedgecp.exe Location: WININET.dll!CHttpHeaderParser::ParseStatusLine + 0x80 Security impact: Potentially exploitable security issue
WININET.dll!CHttpHeaderParser::ParseStatusLine + 0x80 (CB in id)
WININET.dll!HTTP_REQUEST_HANDLE_OBJECT::_ParseResponseLine + 0x71 (A2 in id)
WININET.dll!HTTP_REQUEST_HANDLE_OBJECT::UpdateResponseHeaders + 0x4F (08 in id)
WININET.dll!HTTP_REQUEST_HANDLE_OBJECT::ReceiveResponse_Fsm + 0xC8
WININET.dll!CFsm_ReceiveResponse::RunSM + 0x3C
WININET.dll!CFsm::Run + 0x530
WININET.dll!CFsm::RunWorkItem + 0x25B
WININET.dll!CSocket::ReceiveCompletion + 0x84
WININET.dll!CWxSocket::IoCompletionCallback + 0x6F
KERNELBASE.dll!BasepTpIoCallback + 0x3A
ntdll.dll!TppIopExecuteCallback + 0x16F
ntdll.dll!TppWorkerThread + 0x866
KERNEL32.DLL!BaseThreadInitThunk + 0x24
ntdll.dll!__RtlUserThreadStart + 0x2B
ntdll.dll!_RtlUserThreadStart + 0x1B
Image path: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
Image name: microsoftedgecp.exe
Timestamp: Thu Jul 09 20:23:10 2015 (559F3A9E)
CheckSum: 00056441
ImageSize: 0004B000
File version: 11.0.10240.16384
Product version: 11.0.10240.16384
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft Edge
InternalName: MicrosoftEdgeCP
OriginalFilename: MicrosoftEdgeCP.exe
ProductVersion: 11.00.10240.16384
FileVersion: 11.00.10240.16384 (th1.150709-1700)
FileDescription: Microsoft Edge Content Process
LegalCopyright: � Microsoft Corporation. All rights reserved.
address 06989000 found in
_DPH_HEAP_ROOT @ 7c1000
in busy allocation ( DPH_HEAP_BLOCK: UserAddr UserSize - VirtAddr VirtSize)
6a20750: 6988f50 ab - 6988000 2000
6c469abc verifier!AVrfDebugPageHeapAllocate+0x0000023c
6c469ef6 verifier!AVrfDebugPageHeapReAllocate+0x000001c6
771732dc ntdll!RtlDebugReAllocateHeap+0x0000003d
7712d42f ntdll!RtlpReAllocateHeapInternal+0x0006dcbf
770bf74b ntdll!RtlReAllocateHeap+0x0000002b
6c271f82 WININET!ResizeBuffer+0x0000003c
6c292437 WININET!CFsm_SocketReceive::RunSM+0x00000057
6c29111d WININET!CFsm::Run+0x0000040d
6c291fdb WININET!CFsm::RunWorkItem+0x0000025b
6c265054 WININET!CSocket::ReceiveCompletion+0x00000084
6c264e8f WININET!CWxSocket::IoCompletionCallback+0x0000006f
74a85c4a KERNELBASE!BasepTpIoCallback+0x0000003a
770cebbf ntdll!TppIopExecuteCallback+0x0000016f
770cd8d6 ntdll!TppWorkerThread+0x00000866
7700dea4 KERNEL32!BaseThreadInitThunk+0x00000024
770e055e ntdll!__RtlUserThreadStart+0x0000002b
770e052d ntdll!_RtlUserThreadStart+0x0000001b
Microsoft (R) Windows Debugger Version 6.3.9600.16384 X86
Copyright (c) Microsoft Corporation. All rights reserved.
*** wait with pending attach
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*C:\Symbols*\\server\Symbols
Deferred srv*http://symbols.mozilla.org/firefox
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is:
ModLoad: 00fe0000 00ff2000 C:\Windows\System32\RuntimeBroker.exe
ModLoad: 77090000 77209000 C:\Windows\SYSTEM32\ntdll.dll
ModLoad: 6c460000 6c4c1000 C:\Windows\system32\verifier.dll
ModLoad: 76ff0000 77085000 C:\Windows\system32\KERNEL32.DLL
ModLoad: 749b0000 74b27000 C:\Windows\system32\KERNELBASE.dll
ModLoad: 75090000 7514e000 C:\Windows\system32\msvcrt.dll
ModLoad: 753e0000 754a2000 C:\Windows\system32\RPCRT4.dll
ModLoad: 75150000 7530a000 C:\Windows\system32\combase.dll
ModLoad: 74200000 74244000 C:\Windows\system32\powrprof.dll
ModLoad: 741f0000 741fc000 C:\Windows\system32\kernel.appcore.dll
ModLoad: 74010000 74069000 C:\Windows\System32\bcryptPrimitives.dll
ModLoad: 74cf0000 74dda000 C:\Windows\system32\ole32.dll
ModLoad: 75740000 75783000 C:\Windows\system32\sechost.dll
ModLoad: 74de0000 74f35000 C:\Windows\system32\GDI32.dll
ModLoad: 75500000 75634000 C:\Windows\system32\USER32.dll
ModLoad: 74f40000 74f6f000 C:\Windows\system32\IMM32.DLL
ModLoad: 75ab0000 75bd0000 C:\Windows\system32\MSCTF.dll
ModLoad: 74f70000 74ff2000 C:\Windows\system32\clbcatq.dll
ModLoad: 73bb0000 73bc3000 C:\Windows\SYSTEM32\cryptsp.dll
ModLoad: 74140000 7415d000 C:\Windows\System32\bcrypt.dll
ModLoad: 73890000 738bf000 C:\Windows\system32\rsaenh.dll
ModLoad: 73ce0000 73cea000 C:\Windows\System32\CRYPTBASE.dll
ModLoad: 6ba70000 6ba8d000 C:\Windows\System32\Windows.ApplicationModel.Core.dll
ModLoad: 74250000 7425f000 C:\Windows\system32\profapi.dll
ModLoad: 72fb0000 7306c000 C:\Windows\SYSTEM32\twinapi.appcore.dll
ModLoad: 73960000 73979000 C:\Windows\System32\USERENV.dll
ModLoad: 6ad40000 6ad51000 C:\Windows\SYSTEM32\profext.dll
ModLoad: 73760000 73788000 C:\Windows\SYSTEM32\ntmarta.dll
ModLoad: 73e90000 73eb4000 C:\Windows\system32\SspiCli.dll
ModLoad: 6b570000 6b581000 C:\Windows\SYSTEM32\capauthz.dll
ModLoad: 72d90000 72e21000 C:\Windows\system32\apphelp.dll
(100c.1780): Break instruction exception - code 80000003 (first chance)
eax=7f6d6000 ebx=00000000 ecx=7714afb0 edx=00401100 esi=7714afb0 edi=7714afb0
eip=77114550 esp=06dcfba4 ebp=06dcfbd0 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!DbgBreakPoint:
77114550 cc int 3
0:008> .lastevent
Last event: 100c.1780: Break instruction exception - code 80000003 (first chance)
debugger time: Wed Sep 2 12:43:55.410 2015 (UTC - 7:00)
0:008> .childdbg 1
Processes created by the current process will be debugged
0:008> .attach 0n4452
Attach will occur on next execution
0:008> g
*** wait with pending attach
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*C:\Symbols*\\server\Symbols
Deferred srv*http://symbols.mozilla.org/firefox
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is:
ModLoad: 00a30000 00a38000 C:\Windows\system32\browser_broker.exe
ModLoad: 77090000 77209000 C:\Windows\SYSTEM32\ntdll.dll
ModLoad: 6c460000 6c4c1000 C:\Windows\system32\verifier.dll
ModLoad: 76ff0000 77085000 C:\Windows\system32\KERNEL32.DLL
ModLoad: 749b0000 74b27000 C:\Windows\system32\KERNELBASE.dll
ModLoad: 75090000 7514e000 C:\Windows\system32\msvcrt.dll
ModLoad: 75150000 7530a000 C:\Windows\system32\combase.dll
ModLoad: 753e0000 754a2000 C:\Windows\system32\RPCRT4.dll
ModLoad: 75740000 75783000 C:\Windows\system32\sechost.dll
ModLoad: 75500000 75634000 C:\Windows\system32\user32.dll
ModLoad: 74de0000 74f35000 C:\Windows\system32\GDI32.dll
ModLoad: 74f40000 74f6f000 C:\Windows\system32\IMM32.DLL
ModLoad: 75ab0000 75bd0000 C:\Windows\system32\MSCTF.dll
ModLoad: 741f0000 741fc000 C:\Windows\system32\kernel.appcore.dll
ModLoad: 74010000 74069000 C:\Windows\system32\bcryptPrimitives.dll
ModLoad: 72f10000 72f89000 C:\Windows\system32\uxtheme.dll
ModLoad: 6ba90000 6baa4000 C:\Windows\SYSTEM32\browserbroker.dll
ModLoad: 75790000 7581d000 C:\Windows\system32\shcore.dll
ModLoad: 756a0000 75732000 C:\Windows\system32\OLEAUT32.dll
ModLoad: 747e0000 74955000 C:\Windows\system32\CRYPT32.dll
ModLoad: 741e0000 741ee000 C:\Windows\system32\MSASN1.dll
ModLoad: 6e050000 6e311000 C:\Windows\SYSTEM32\iertutil.dll
ModLoad: 75a30000 75aab000 C:\Windows\system32\advapi32.dll
ModLoad: 6cec0000 6d020000 C:\Windows\SYSTEM32\urlmon.dll
ModLoad: 754b0000 754f4000 C:\Windows\system32\shlwapi.dll
ModLoad: 73670000 73687000 C:\Windows\SYSTEM32\MPR.dll
ModLoad: 6c210000 6c434000 C:\Windows\SYSTEM32\WININET.dll
ModLoad: 71020000 7104d000 C:\Windows\SYSTEM32\XmlLite.dll
ModLoad: 73ce0000 73cea000 C:\Windows\SYSTEM32\CRYPTBASE.dll
ModLoad: 738c0000 738c8000 C:\Windows\SYSTEM32\DPAPI.DLL
ModLoad: 74f70000 74ff2000 C:\Windows\system32\clbcatq.dll
ModLoad: 73bb0000 73bc3000 C:\Windows\SYSTEM32\cryptsp.dll
ModLoad: 74140000 7415d000 C:\Windows\system32\bcrypt.dll
ModLoad: 73890000 738bf000 C:\Windows\system32\rsaenh.dll
ModLoad: 6b220000 6b26c000 C:\Windows\System32\ieproxy.dll
ModLoad: 74cf0000 74dda000 C:\Windows\system32\ole32.dll
ModLoad: 73e90000 73eb4000 C:\Windows\SYSTEM32\SspiCli.dll
ModLoad: 75c30000 76fee000 C:\Windows\system32\SHELL32.dll
ModLoad: 74300000 747dc000 C:\Windows\system32\windows.storage.dll
ModLoad: 74200000 74244000 C:\Windows\system32\powrprof.dll
ModLoad: 74250000 7425f000 C:\Windows\system32\profapi.dll
(1164.13a8): Break instruction exception - code 80000003 (first chance)
eax=7fde4000 ebx=00000000 ecx=7714afb0 edx=00401100 esi=7714afb0 edi=7714afb0
eip=77114550 esp=0720ff18 ebp=0720ff44 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!DbgBreakPoint:
77114550 cc int 3
1:019> .lastevent
Last event: 1164.13a8: Break instruction exception - code 80000003 (first chance)
debugger time: Wed Sep 2 12:43:56.582 2015 (UTC - 7:00)
1:019> .childdbg 1
Processes created by the current process will be debugged
1:019> .attach 0n5428
Attach will occur on next execution
1:019> g
*** wait with pending attach
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*C:\Symbols*\\server\Symbols
Deferred srv*http://symbols.mozilla.org/firefox
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is:
ModLoad: 010a0000 014c4000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
ModLoad: 77090000 77209000 C:\Windows\SYSTEM32\ntdll.dll
ModLoad: 6c460000 6c4c1000 C:\Windows\system32\verifier.dll
ModLoad: 76ff0000 77085000 C:\Windows\system32\KERNEL32.DLL
ModLoad: 749b0000 74b27000 C:\Windows\system32\KERNELBASE.dll
ModLoad: 72d90000 72e21000 C:\Windows\system32\apphelp.dll
ModLoad: 75a30000 75aab000 C:\Windows\system32\ADVAPI32.dll
ModLoad: 75090000 7514e000 C:\Windows\system32\msvcrt.dll
ModLoad: 75740000 75783000 C:\Windows\system32\sechost.dll
ModLoad: 753e0000 754a2000 C:\Windows\system32\RPCRT4.dll
ModLoad: 74cf0000 74dda000 C:\Windows\system32\ole32.dll
ModLoad: 75150000 7530a000 C:\Windows\system32\combase.dll
ModLoad: 74de0000 74f35000 C:\Windows\system32\GDI32.dll
ModLoad: 75500000 75634000 C:\Windows\system32\USER32.dll
ModLoad: 72940000 72989000 C:\Windows\SYSTEM32\wincorlib.DLL
ModLoad: 756a0000 75732000 C:\Windows\system32\OLEAUT32.dll
ModLoad: 74f40000 74f6f000 C:\Windows\system32\IMM32.DLL
ModLoad: 75ab0000 75bd0000 C:\Windows\system32\MSCTF.dll
ModLoad: 741f0000 741fc000 C:\Windows\system32\kernel.appcore.dll
ModLoad: 74010000 74069000 C:\Windows\SYSTEM32\bcryptPrimitives.dll
ModLoad: 73bb0000 73bc3000 C:\Windows\SYSTEM32\cryptsp.dll
ModLoad: 74140000 7415d000 C:\Windows\SYSTEM32\bcrypt.dll
ModLoad: 6e3a0000 6f012000 C:\Windows\System32\Windows.UI.Xaml.dll
ModLoad: 711d0000 71295000 C:\Windows\SYSTEM32\wintypes.dll
ModLoad: 72830000 728c1000 C:\Windows\SYSTEM32\CoreMessaging.dll
ModLoad: 72990000 729e1000 C:\Windows\SYSTEM32\Bcp47Langs.dll
ModLoad: 6e050000 6e311000 C:\Windows\SYSTEM32\iertutil.dll
ModLoad: 728f0000 7293d000 C:\Windows\SYSTEM32\NInput.dll
ModLoad: 75790000 7581d000 C:\Windows\system32\shcore.dll
ModLoad: 73890000 738bf000 C:\Windows\system32\rsaenh.dll
ModLoad: 72fb0000 7306c000 C:\Windows\System32\twinapi.appcore.dll
ModLoad: 73960000 73979000 C:\Windows\SYSTEM32\USERENV.dll
ModLoad: 74250000 7425f000 C:\Windows\system32\profapi.dll
ModLoad: 73ce0000 73cea000 C:\Windows\SYSTEM32\CRYPTBASE.dll
ModLoad: 6d340000 6d353000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\EShims.dll
ModLoad: 62210000 62620000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\eModel.dll
ModLoad: 754b0000 754f4000 C:\Windows\system32\SHLWAPI.dll
ModLoad: 75c30000 76fee000 C:\Windows\system32\SHELL32.dll
ModLoad: 74300000 747dc000 C:\Windows\system32\windows.storage.dll
ModLoad: 74200000 74244000 C:\Windows\system32\powrprof.dll
ModLoad: 74b30000 74b66000 C:\Windows\system32\cfgmgr32.dll
ModLoad: 73200000 7325d000 C:\Windows\SYSTEM32\firewallapi.dll
ModLoad: 731b0000 731dd000 C:\Windows\SYSTEM32\fwbase.dll
ModLoad: 6bd80000 6bf87000 C:\Windows\System32\ActXPrxy.dll
ModLoad: 6b5a0000 6b750000 C:\Windows\system32\CoreUIComponents.dll
ModLoad: 72f10000 72f89000 C:\Windows\system32\uxtheme.dll
ModLoad: 72010000 7202d000 C:\Windows\SYSTEM32\dwmapi.dll
ModLoad: 723b0000 7242e000 C:\Windows\SYSTEM32\dxgi.dll
ModLoad: 72190000 723a3000 C:\Windows\SYSTEM32\d3d11.dll
ModLoad: 6aaf0000 6ab19000 C:\Windows\System32\Windows.ApplicationModel.dll
ModLoad: 6f910000 6fb28000 C:\Windows\SYSTEM32\d3d10warp.dll
ModLoad: 69910000 69d98000 C:\Windows\SYSTEM32\d2d1.dll
ModLoad: 61f70000 62204000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\eView.dll
ModLoad: 6cec0000 6d020000 C:\Windows\SYSTEM32\urlmon.dll
ModLoad: 72030000 720d8000 C:\Windows\System32\dcomp.dll
ModLoad: 6f020000 6f0eb000 C:\Windows\System32\MrmCoreR.dll
ModLoad: 725c0000 72635000 C:\Windows\System32\Windows.UI.dll
ModLoad: 6b1d0000 6b20f000 C:\Windows\system32\DataExchange.dll
ModLoad: 6ad40000 6ad51000 C:\Windows\SYSTEM32\profext.dll
ModLoad: 73760000 73788000 C:\Windows\SYSTEM32\ntmarta.dll
ModLoad: 72640000 72782000 C:\Windows\SYSTEM32\PROPSYS.dll
ModLoad: 6c210000 6c434000 C:\Windows\SYSTEM32\WININET.dll
ModLoad: 73e90000 73eb4000 C:\Windows\SYSTEM32\SspiCli.dll
ModLoad: 70050000 7007f000 C:\Windows\SYSTEM32\policymanager.dll
ModLoad: 6ff90000 6fff5000 C:\Windows\SYSTEM32\msvcp110_win.dll
ModLoad: 71020000 7104d000 C:\Windows\SYSTEM32\XmlLite.dll
ModLoad: 75bd0000 75c2c000 C:\Windows\system32\WS2_32.dll
ModLoad: 75080000 75087000 C:\Windows\system32\NSI.dll
ModLoad: 6c530000 6c541000 C:\Windows\SYSTEM32\ondemandconnroutehelper.dll
ModLoad: 71c60000 71c90000 C:\Windows\SYSTEM32\IPHLPAPI.DLL
ModLoad: 71c40000 71c48000 C:\Windows\SYSTEM32\WINNSI.DLL
ModLoad: 715c0000 71667000 C:\Windows\SYSTEM32\winhttp.dll
ModLoad: 73b60000 73bb0000 C:\Windows\system32\mswsock.dll
ModLoad: 6d2f0000 6d2ff000 C:\Windows\System32\Windows.Shell.ServiceHostBuilder.dll
ModLoad: 6b800000 6b80c000 C:\Windows\system32\execmodelproxy.dll
ModLoad: 645c0000 64732000 C:\Windows\SYSTEM32\ieapfltr.dll
ModLoad: 6d8b0000 6d9e4000 C:\Windows\System32\Windows.Globalization.dll
ModLoad: 6b530000 6b565000 C:\Windows\System32\netprofm.dll
ModLoad: 6d9f0000 6dbe0000 C:\Windows\SYSTEM32\dwrite.dll
ModLoad: 6b4a0000 6b4a9000 C:\Windows\System32\npmproxy.dll
ModLoad: 739b0000 73a34000 C:\Windows\SYSTEM32\DNSAPI.dll
ModLoad: 75000000 75058000 C:\Windows\system32\coml2.dll
ModLoad: 72c20000 72c41000 C:\Windows\SYSTEM32\SLC.dll
ModLoad: 72bd0000 72bed000 C:\Windows\SYSTEM32\sppc.dll
ModLoad: 66150000 66199000 C:\Windows\System32\Windows.Graphics.dll
ModLoad: 6f4c0000 6f4c8000 C:\Windows\System32\rasadhlp.dll
ModLoad: 70660000 706a6000 C:\Windows\System32\fwpuclnt.dll
ModLoad: 6b9a0000 6b9d3000 C:\Windows\System32\execmodelclient.dll
ModLoad: 70a10000 70a64000 C:\Windows\SYSTEM32\MMDevAPI.DLL
ModLoad: 72ee0000 72f01000 C:\Windows\SYSTEM32\DEVOBJ.dll
ModLoad: 731e0000 731fe000 C:\Windows\System32\rmclient.dll
ModLoad: 6ba70000 6ba8d000 C:\Windows\System32\Windows.ApplicationModel.Core.dll
ModLoad: 69680000 69901000 C:\Windows\SYSTEM32\msftedit.dll
ModLoad: 6d300000 6d324000 C:\Windows\SYSTEM32\globinputhost.dll
ModLoad: 71ff0000 72002000 C:\Windows\System32\Windows.Globalization.Fontgroups.dll
ModLoad: 72e30000 72e39000 C:\Windows\SYSTEM32\fontgroupsoverride.dll
ModLoad: 6ba50000 6ba6d000 C:\Windows\System32\Windows.System.Profile.RetailInfo.dll
ModLoad: 6b750000 6b7e9000 C:\Windows\system32\twinapi.dll
ModLoad: 71f80000 71ff0000 C:\Windows\system32\directmanipulation.dll
(1534.98): Break instruction exception - code 80000003 (first chance)
eax=7f386000 ebx=00000000 ecx=7714afb0 edx=00401100 esi=7714afb0 edi=7714afb0
eip=77114550 esp=221ffbf8 ebp=221ffc24 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!DbgBreakPoint:
77114550 cc int 3
2:056> .lastevent
Last event: 1534.98: Break instruction exception - code 80000003 (first chance)
debugger time: Wed Sep 2 12:43:57.691 2015 (UTC - 7:00)
2:056> .childdbg 1
Processes created by the current process will be debugged
2:056> .attach 0n5224
Attach will occur on next execution
2:056> g
*** wait with pending attach
************* Symbol Path validation summary **************
Response Time (ms) Location
Deferred srv*http://msdl.microsoft.com/download/symbols
Deferred cache*C:\Symbols*\\server\Symbols
Deferred srv*http://symbols.mozilla.org/firefox
Deferred srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Symbol search path is: srv*http://msdl.microsoft.com/download/symbols;cache*C:\Symbols*\\server\Symbols;srv*http://symbols.mozilla.org/firefox;srv*http://chromium-browser-symsrv.commondatastorage.googleapis.com
Executable search path is:
ModLoad: 00f80000 00fcb000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
ModLoad: 77090000 77209000 C:\Windows\SYSTEM32\ntdll.dll
ModLoad: 6c460000 6c4c1000 C:\Windows\system32\verifier.dll
ModLoad: 76ff0000 77085000 C:\Windows\system32\KERNEL32.DLL
ModLoad: 749b0000 74b27000 C:\Windows\system32\KERNELBASE.dll
ModLoad: 72d90000 72e21000 C:\Windows\system32\apphelp.dll
ModLoad: 75a30000 75aab000 C:\Windows\system32\ADVAPI32.dll
ModLoad: 75090000 7514e000 C:\Windows\system32\msvcrt.dll
ModLoad: 75740000 75783000 C:\Windows\system32\sechost.dll
ModLoad: 753e0000 754a2000 C:\Windows\system32\RPCRT4.dll
ModLoad: 75790000 7581d000 C:\Windows\system32\shcore.dll
ModLoad: 75150000 7530a000 C:\Windows\system32\combase.dll
ModLoad: 6e050000 6e311000 C:\Windows\SYSTEM32\iertutil.dll
ModLoad: 75500000 75634000 C:\Windows\system32\user32.dll
ModLoad: 74de0000 74f35000 C:\Windows\system32\GDI32.dll
ModLoad: 74f40000 74f6f000 C:\Windows\system32\IMM32.DLL
ModLoad: 75ab0000 75bd0000 C:\Windows\system32\MSCTF.dll
ModLoad: 62210000 62620000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\EMODEL.dll
ModLoad: 754b0000 754f4000 C:\Windows\system32\SHLWAPI.dll
ModLoad: 75c30000 76fee000 C:\Windows\system32\SHELL32.dll
ModLoad: 74300000 747dc000 C:\Windows\system32\windows.storage.dll
ModLoad: 741f0000 741fc000 C:\Windows\system32\kernel.appcore.dll
ModLoad: 74200000 74244000 C:\Windows\system32\powrprof.dll
ModLoad: 74250000 7425f000 C:\Windows\system32\profapi.dll
ModLoad: 74cf0000 74dda000 C:\Windows\system32\ole32.dll
ModLoad: 756a0000 75732000 C:\Windows\system32\OLEAUT32.dll
ModLoad: 74b30000 74b66000 C:\Windows\system32\cfgmgr32.dll
ModLoad: 73200000 7325d000 C:\Windows\SYSTEM32\firewallapi.dll
ModLoad: 731b0000 731dd000 C:\Windows\SYSTEM32\fwbase.dll
ModLoad: 6d340000 6d353000 C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\EShims.dll
ModLoad: 74010000 74069000 C:\Windows\SYSTEM32\bcryptPrimitives.dll
ModLoad: 72f10000 72f89000 C:\Windows\system32\uxtheme.dll
ModLoad: 73bb0000 73bc3000 C:\Windows\SYSTEM32\cryptsp.dll
ModLoad: 74140000 7415d000 C:\Windows\SYSTEM32\bcrypt.dll
ModLoad: 73890000 738bf000 C:\Windows\system32\rsaenh.dll
ModLoad: 73ce0000 73cea000 C:\Windows\SYSTEM32\CRYPTBASE.dll
ModLoad: 72fb0000 7306c000 C:\Windows\SYSTEM32\twinapi.appcore.dll
ModLoad: 73960000 73979000 C:\Windows\SYSTEM32\USERENV.dll
ModLoad: 64780000 65980000 C:\Windows\SYSTEM32\EDGEHTML.dll
ModLoad: 63e70000 644ad000 C:\Windows\SYSTEM32\chakra.dll
ModLoad: 64740000 64773000 C:\Windows\SYSTEM32\MLANG.dll
ModLoad: 711d0000 71295000 C:\Windows\System32\WinTypes.dll
ModLoad: 6c210000 6c434000 C:\Windows\SYSTEM32\WININET.dll
ModLoad: 73e90000 73eb4000 C:\Windows\SYSTEM32\SspiCli.dll
ModLoad: 75bd0000 75c2c000 C:\Windows\system32\WS2_32.dll
ModLoad: 75080000 75087000 C:\Windows\system32\NSI.dll
ModLoad: 6c530000 6c541000 C:\Windows\SYSTEM32\ondemandconnroutehelper.dll
ModLoad: 71c60000 71c90000 C:\Windows\SYSTEM32\IPHLPAPI.DLL
ModLoad: 71c40000 71c48000 C:\Windows\SYSTEM32\WINNSI.DLL
ModLoad: 715c0000 71667000 C:\Windows\SYSTEM32\winhttp.dll
ModLoad: 6ad40000 6ad51000 C:\Windows\SYSTEM32\profext.dll
ModLoad: 73760000 73788000 C:\Windows\SYSTEM32\ntmarta.dll
ModLoad: 73b60000 73bb0000 C:\Windows\system32\mswsock.dll
ModLoad: 72010000 7202d000 C:\Windows\SYSTEM32\dwmapi.dll
ModLoad: 6cec0000 6d020000 C:\Windows\SYSTEM32\urlmon.dll
ModLoad: 645c0000 64732000 C:\Windows\SYSTEM32\ieapfltr.dll
ModLoad: 70050000 7007f000 C:\Windows\SYSTEM32\policymanager.dll
ModLoad: 6ff90000 6fff5000 C:\Windows\SYSTEM32\msvcp110_win.dll
ModLoad: 71020000 7104d000 C:\Windows\SYSTEM32\XmlLite.dll
ModLoad: 739b0000 73a34000 C:\Windows\SYSTEM32\DNSAPI.dll
ModLoad: 6b1d0000 6b20f000 C:\Windows\system32\dataexchange.dll
ModLoad: 69910000 69d98000 C:\Windows\SYSTEM32\d2d1.dll
ModLoad: 72190000 723a3000 C:\Windows\SYSTEM32\d3d11.dll
ModLoad: 72030000 720d8000 C:\Windows\SYSTEM32\dcomp.dll
ModLoad: 723b0000 7242e000 C:\Windows\SYSTEM32\dxgi.dll
ModLoad: 6b750000 6b7e9000 C:\Windows\system32\twinapi.dll
ModLoad: 728f0000 7293d000 C:\Windows\SYSTEM32\ninput.dll
ModLoad: 6d9f0000 6dbe0000 C:\Windows\SYSTEM32\DWrite.dll
ModLoad: 6f910000 6fb28000 C:\Windows\SYSTEM32\d3d10warp.dll
ModLoad: 725c0000 72635000 C:\Windows\System32\Windows.UI.dll
ModLoad: 68a20000 68a2e000 C:\Windows\system32\msimtf.dll
ModLoad: 71f80000 71ff0000 C:\Windows\system32\directmanipulation.dll
ModLoad: 6f020000 6f0eb000 C:\Windows\System32\MrmCoreR.dll
ModLoad: 72990000 729e1000 C:\Windows\SYSTEM32\Bcp47Langs.dll
ModLoad: 6d8b0000 6d9e4000 C:\Windows\SYSTEM32\windows.globalization.dll
ModLoad: 6b220000 6b26c000 C:\Windows\System32\ieproxy.dll
ModLoad: 70660000 706a6000 C:\Windows\System32\fwpuclnt.dll
ModLoad: 6f4c0000 6f4c8000 C:\Windows\System32\rasadhlp.dll
(1468.5e8): Break instruction exception - code 80000003 (first chance)
eax=7fbe7000 ebx=00000000 ecx=7714afb0 edx=00401100 esi=7714afb0 edi=7714afb0
eip=77114550 esp=0d83feec ebp=0d83ff18 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!DbgBreakPoint:
77114550 cc int 3
3:076> .lastevent
Last event: 1468.5e8: Break instruction exception - code 80000003 (first chance)
debugger time: Wed Sep 2 12:43:58.769 2015 (UTC - 7:00)
3:076> .childdbg 1
Processes created by the current process will be debugged
3:076> |~[0n4108]s;~*m;~
eax=06584000 ebx=00000000 ecx=004bf92c edx=771146f0 esi=00000002 edi=00000002
eip=771146f0 esp=004bf92c ebp=004bfac0 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
771146f0 c3 ret
. 0 Id: 100c.12dc Suspend: 1 Teb: 7f6df000 Unfrozen
1 Id: 100c.1114 Suspend: 1 Teb: 7f6de000 Unfrozen
2 Id: 100c.8e4 Suspend: 1 Teb: 7f6dd000 Unfrozen
3 Id: 100c.324 Suspend: 1 Teb: 7f6dc000 Unfrozen
4 Id: 100c.e70 Suspend: 1 Teb: 7f6db000 Unfrozen
5 Id: 100c.e20 Suspend: 1 Teb: 7f6d9000 Unfrozen
6 Id: 100c.12d4 Suspend: 1 Teb: 7f6d8000 Unfrozen
7 Id: 100c.115c Suspend: 1 Teb: 7f6d7000 Unfrozen
0:000> |~[0n4452]s;~*m;~
eax=008af8bc ebx=00000000 ecx=008af658 edx=771146f0 esi=00000002 edi=00000002
eip=771146f0 esp=008af658 ebp=008af7ec iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
771146f0 c3 ret
. 9 Id: 1164.818 Suspend: 1 Teb: 7fdef000 Unfrozen
10 Id: 1164.1208 Suspend: 1 Teb: 7fdee000 Unfrozen
11 Id: 1164.13c Suspend: 1 Teb: 7fded000 Unfrozen
12 Id: 1164.a24 Suspend: 1 Teb: 7fdeb000 Unfrozen
13 Id: 1164.e54 Suspend: 1 Teb: 7fdea000 Unfrozen
14 Id: 1164.a1c Suspend: 1 Teb: 7fde9000 Unfrozen
15 Id: 1164.1200 Suspend: 1 Teb: 7fde8000 Unfrozen
16 Id: 1164.b7c Suspend: 1 Teb: 7fde7000 Unfrozen
17 Id: 1164.d14 Suspend: 1 Teb: 7fde6000 Unfrozen
18 Id: 1164.1120 Suspend: 1 Teb: 7fde5000 Unfrozen
1:009> |~[0n5428]s;~*m;~
eax=0ba60000 ebx=00000000 ecx=045cf6c4 edx=771146f0 esi=00000002 edi=00000002
eip=771146f0 esp=045cf6c4 ebp=045cf858 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!KiFastSystemCallRet:
771146f0 c3 ret
. 8 Id: 1534.634 Suspend: 1 Teb: 7f4cf000 Unfrozen
20 Id: 1534.1558 Suspend: 1 Teb: 7f4ce000 Unfrozen
21 Id: 1534.1300 Suspend: 1 Teb: 7f4cd000 Unfrozen
22 Id: 1534.119c Suspend: 1 Teb: 7f4cc000 Unfrozen
23 Id: 1534.1504 Suspend: 1 Teb: 7f4ca000 Unfrozen
24 Id: 1534.ce8 Suspend: 1 Teb: 7f4c9000 Unfrozen
25 Id: 1534.734 Suspend: 1 Teb: 7f4c8000 Unfrozen
26 Id: 1534.1794 Suspend: 1 Teb: 7f4c7000 Unfrozen
27 Id: 1534.944 Suspend: 1 Teb: 7f4c6000 Unfrozen
28 Id: 1534.16f8 Suspend: 1 Teb: 7f4c5000 Unfrozen
29 Id: 1534.1758 Suspend: 1 Teb: 7f4c4000 Unfrozen
30 Id: 1534.1260 Suspend: 1 Teb: 7f4c3000 Unfrozen
31 Id: 1534.1708 Suspend: 1 Teb: 7f39f000 Unfrozen
32 Id: 1534.16b4 Suspend: 1 Teb: 7f39e000 Unfrozen
33 Id: 1534.428 Suspend: 1 Teb: 7f39d000 Unfrozen
34 Id: 1534.121c Suspend: 1 Teb: 7f39c000 Unfrozen
35 Id: 1534.1408 Suspend: 1 Teb: 7f39a000 Unfrozen
36 Id: 1534.290 Suspend: 1 Teb: 7f399000 Unfrozen
37 Id: 1534.130c Suspend: 1 Teb: 7f398000 Unfrozen
38 Id: 1534.1368 Suspend: 1 Teb: 7f397000 Unfrozen
39 Id: 1534.10e4 Suspend: 1 Teb: 7f39b000 Unfrozen
40 Id: 1534.31c Suspend: 1 Teb: 7f396000 Unfrozen
41 Id: 1534.f7c Suspend: 1 Teb: 7f395000 Unfrozen
42 Id: 1534.17b0 Suspend: 1 Teb: 7f394000 Unfrozen
43 Id: 1534.a30 Suspend: 1 Teb: 7f393000 Unfrozen
44 Id: 1534.b1c Suspend: 1 Teb: 7f392000 Unfrozen
45 Id: 1534.1150 Suspend: 1 Teb: 7f391000 Unfrozen
46 Id: 1534.1224 Suspend: 0 Teb: 7f390000 Unfrozen
47 Id: 1534.13a4 Suspend: 0 Teb: 7f38f000 Unfrozen
48 Id: 1534.490 Suspend: 0 Teb: 7f38e000 Unfrozen
49 Id: 1534.1474 Suspend: 0 Teb: 7f38d000 Unfrozen
50 Id: 1534.c24 Suspend: 0 Teb: 7f38c000 Unfrozen
51 Id: 1534.9a8 Suspend: 0 Teb: 7f38b000 Unfrozen
52 Id: 1534.29c Suspend: 0 Teb: 7f38a000 Unfrozen
53 Id: 1534.1444 Suspend: 0 Teb: 7f389000 Unfrozen
54 Id: 1534.1118 Suspend: 0 Teb: 7f388000 Unfrozen
55 Id: 1534.a38 Suspend: 0 Teb: 7f387000 Unfrozen
2:008> |~[0n5224]s;~*m;~
eax=7fbe7000 ebx=00000000 ecx=7714afb0 edx=00401100 esi=7714afb0 edi=7714afb0
eip=77114550 esp=0d83feec ebp=0d83ff18 iopl=0 nv up ei pl zr na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00000246
ntdll!DbgBreakPoint:
77114550 cc int 3
19 Id: 1468.c78 Suspend: 1 Teb: 7fd1f000 Unfrozen
57 Id: 1468.d64 Suspend: 1 Teb: 7fd1e000 Unfrozen
58 Id: 1468.1550 Suspend: 1 Teb: 7fd1d000 Unfrozen
59 Id: 1468.8dc Suspend: 1 Teb: 7fd1c000 Unfrozen
60 Id: 1468.64 Suspend: 1 Teb: 7fd1b000 Unfrozen
61 Id: 1468.10d0 Suspend: 1 Teb: 7fd1a000 Unfrozen
62 Id: 1468.a98 Suspend: 1 Teb: 7fd19000 Unfrozen
63 Id: 1468.1178 Suspend: 1 Teb: 7fd18000 Unfrozen
64 Id: 1468.89c Suspend: 1 Teb: 7fd17000 Unfrozen
65 Id: 1468.158c Suspend: 1 Teb: 7fd16000 Unfrozen
66 Id: 1468.1790 Suspend: 1 Teb: 7fd14000 Unfrozen
67 Id: 1468.1190 Suspend: 1 Teb: 7fd13000 Unfrozen
68 Id: 1468.320 Suspend: 1 Teb: 7fbef000 Unfrozen
69 Id: 1468.10f0 Suspend: 1 Teb: 7fbee000 Unfrozen
70 Id: 1468.328 Suspend: 1 Teb: 7fbed000 Unfrozen
71 Id: 1468.70c Suspend: 1 Teb: 7fbec000 Unfrozen
72 Id: 1468.1500 Suspend: 1 Teb: 7fbeb000 Unfrozen
73 Id: 1468.12cc Suspend: 1 Teb: 7fbea000 Unfrozen
74 Id: 1468.a70 Suspend: 1 Teb: 7fbe9000 Unfrozen
75 Id: 1468.47c Suspend: 1 Teb: 7fbe8000 Unfrozen
. 76 Id: 1468.5e8 Suspend: 0 Teb: 7fbe7000 Unfrozen
3:076> g
ModLoad: 6b220000 6b26c000 C:\Windows\System32\ieproxy.dll
ModLoad: 6c550000 6c561000 C:\Windows\System32\threadpoolwinrt.dll
ModLoad: 66340000 66380000 C:\Windows\System32\Windows.Storage.ApplicationData.dll
(1534.734): Windows Runtime Originate Error - code 40080201 (first chance)
(1534.734): C++ EH exception - code e06d7363 (first chance)
(1534.734): Windows Runtime Originate Error - code 40080201 (first chance)
(1534.734): C++ EH exception - code e06d7363 (first chance)
(1534.734): Windows Runtime Originate Error - code 40080201 (first chance)
(1534.734): C++ EH exception - code e06d7363 (first chance)
ModLoad: 731e0000 731fe000 C:\Windows\System32\rmclient.dll
ModLoad: 72640000 72782000 C:\Windows\SYSTEM32\PROPSYS.dll
ModLoad: 74300000 747dc000 C:\Windows\system32\windows.storage.dll
ModLoad: 75a30000 75aab000 C:\Windows\system32\advapi32.dll
ModLoad: 754b0000 754f4000 C:\Windows\system32\shlwapi.dll
(1468.158c): Access violation - code c0000005 (first chance)
First chance exceptions are reported before any exception handling.
This exception may be expected and handled.
eax=0885f9d0 ebx=0000003f ecx=0885f920 edx=06988fc1 esi=06989000 edi=0000006c
eip=6c2acad0 esp=0885f87c ebp=0885f8e4 iopl=0 nv up ei pl nz na pe nc
cs=001b ss=0023 ds=0023 es=0023 fs=003b gs=0000 efl=00010206
WININET!CHttpHeaderParser::ParseStatusLine+0x80:
6c2acad0 8a06 mov al,byte ptr [esi] ds:0023:06989000=??
3:065> .lastevent
Last event: 1468.158c: Access violation - code c0000005 (first chance)
debugger time: Wed Sep 2 12:44:00.133 2015 (UTC - 7:00)
3:065> !sym quiet
quiet mode - symbol prompts off
3:065> |.
. 3 id: 1468 attach name: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
3:065> .effmach
Effective machine: x86 compatible (x86)
3:065> lm on
start end module name
00f80000 00fcb000 microsoftedgecp microsoftedgecp.exe
62210000 62620000 EMODEL EMODEL.dll
63e70000 644ad000 chakra chakra.dll
645c0000 64732000 ieapfltr ieapfltr.dll
64740000 64773000 MLANG MLANG.dll
64780000 65980000 EDGEHTML EDGEHTML.dll
68a20000 68a2e000 msimtf msimtf.dll
69910000 69d98000 d2d1 d2d1.dll
6ad40000 6ad51000 profext profext.dll
6b1d0000 6b20f000 dataexchange dataexchange.dll
6b220000 6b26c000 ieproxy ieproxy.dll
6b750000 6b7e9000 twinapi twinapi.dll
6c210000 6c434000 WININET WININET.dll
6c460000 6c4c1000 verifier verifier.dll
6c530000 6c541000 ondemandconnroutehelper ondemandconnroutehelper.dll
6cec0000 6d020000 urlmon urlmon.dll
6d340000 6d353000 EShims EShims.dll
6d8b0000 6d9e4000 windows_globalization windows.globalization.dll
6d9f0000 6dbe0000 DWrite DWrite.dll
6e050000 6e311000 iertutil iertutil.dll
6f020000 6f0eb000 MrmCoreR MrmCoreR.dll
6f4c0000 6f4c8000 rasadhlp rasadhlp.dll
6f910000 6fb28000 d3d10warp d3d10warp.dll
6ff90000 6fff5000 msvcp110_win msvcp110_win.dll
70050000 7007f000 policymanager policymanager.dll
70660000 706a6000 fwpuclnt fwpuclnt.dll
71020000 7104d000 XmlLite XmlLite.dll
711d0000 71295000 WinTypes WinTypes.dll
715c0000 71667000 winhttp winhttp.dll
71c40000 71c48000 WINNSI WINNSI.DLL
71c60000 71c90000 IPHLPAPI IPHLPAPI.DLL
71f80000 71ff0000 directmanipulation directmanipulation.dll
72010000 7202d000 dwmapi dwmapi.dll
72030000 720d8000 dcomp dcomp.dll
72190000 723a3000 d3d11 d3d11.dll
723b0000 7242e000 dxgi dxgi.dll
725c0000 72635000 Windows_UI Windows.UI.dll
72640000 72782000 PROPSYS PROPSYS.dll
728f0000 7293d000 ninput ninput.dll
72990000 729e1000 Bcp47Langs Bcp47Langs.dll
72d90000 72e21000 apphelp apphelp.dll
72f10000 72f89000 uxtheme uxtheme.dll
72fb0000 7306c000 twinapi_appcore twinapi.appcore.dll
731b0000 731dd000 fwbase fwbase.dll
731e0000 731fe000 rmclient rmclient.dll
73200000 7325d000 firewallapi firewallapi.dll
73760000 73788000 ntmarta ntmarta.dll
73890000 738bf000 rsaenh rsaenh.dll
73960000 73979000 USERENV USERENV.dll
739b0000 73a34000 DNSAPI DNSAPI.dll
73b60000 73bb0000 mswsock mswsock.dll
73bb0000 73bc3000 cryptsp cryptsp.dll
73ce0000 73cea000 CRYPTBASE CRYPTBASE.dll
73e90000 73eb4000 SspiCli SspiCli.dll
74010000 74069000 bcryptPrimitives bcryptPrimitives.dll
74140000 7415d000 bcrypt bcrypt.dll
741f0000 741fc000 kernel_appcore kernel.appcore.dll
74200000 74244000 powrprof powrprof.dll
74250000 7425f000 profapi profapi.dll
74300000 747dc000 windows_storage windows.storage.dll
749b0000 74b27000 KERNELBASE KERNELBASE.dll
74b30000 74b66000 cfgmgr32 cfgmgr32.dll
74cf0000 74dda000 ole32 ole32.dll
74de0000 74f35000 GDI32 GDI32.dll
74f40000 74f6f000 IMM32 IMM32.DLL
75080000 75087000 NSI NSI.dll
75090000 7514e000 msvcrt msvcrt.dll
75150000 7530a000 combase combase.dll
753e0000 754a2000 RPCRT4 RPCRT4.dll
754b0000 754f4000 SHLWAPI SHLWAPI.dll
75500000 75634000 user32 user32.dll
756a0000 75732000 OLEAUT32 OLEAUT32.dll
75740000 75783000 sechost sechost.dll
75790000 7581d000 shcore shcore.dll
75a30000 75aab000 ADVAPI32 ADVAPI32.dll
75ab0000 75bd0000 MSCTF MSCTF.dll
75bd0000 75c2c000 WS2_32 WS2_32.dll
75c30000 76fee000 SHELL32 SHELL32.dll
76ff0000 77085000 KERNEL32 KERNEL32.DLL
77090000 77209000 ntdll ntdll.dll
3:065> .exr -1
ExceptionAddress: 6c2acad0 (WININET!CHttpHeaderParser::ParseStatusLine+0x00000080)
ExceptionCode: c0000005 (Access violation)
ExceptionFlags: 00000000
NumberParameters: 2
Parameter[0]: 00000000
Parameter[1]: 06989000
Attempt to read from address 06989000
3:065> lmv M *microsoftedgecp.exe
start end module name
00f80000 00fcb000 microsoftedgecp (deferred)
Image path: C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\microsoftedgecp.exe
Image name: microsoftedgecp.exe
Timestamp: Thu Jul 09 20:23:10 2015 (559F3A9E)
CheckSum: 00056441
ImageSize: 0004B000
File version: 11.0.10240.16384
Product version: 11.0.10240.16384
File flags: 0 (Mask 3F)
File OS: 40004 NT Win32
File type: 1.0 App
File date: 00000000.00000000
Translations: 0409.04b0
CompanyName: Microsoft Corporation
ProductName: Microsoft Edge
InternalName: MicrosoftEdgeCP
OriginalFilename: MicrosoftEdgeCP.exe
ProductVersion: 11.00.10240.16384
FileVersion: 11.00.10240.16384 (th1.150709-1700)
FileDescription: Microsoft Edge Content Process
LegalCopyright: � Microsoft Corporation. All rights reserved.
3:065> !heap -p -a 0x6989000
address 06989000 found in
_DPH_HEAP_ROOT @ 7c1000
in busy allocation ( DPH_HEAP_BLOCK: UserAddr UserSize - VirtAddr VirtSize)
6a20750: 6988f50 ab - 6988000 2000
6c469abc verifier!AVrfDebugPageHeapAllocate+0x0000023c
6c469ef6 verifier!AVrfDebugPageHeapReAllocate+0x000001c6
771732dc ntdll!RtlDebugReAllocateHeap+0x0000003d
7712d42f ntdll!RtlpReAllocateHeapInternal+0x0006dcbf
770bf74b ntdll!RtlReAllocateHeap+0x0000002b
6c271f82 WININET!ResizeBuffer+0x0000003c
6c292437 WININET!CFsm_SocketReceive::RunSM+0x00000057
6c29111d WININET!CFsm::Run+0x0000040d
6c291fdb WININET!CFsm::RunWorkItem+0x0000025b
6c265054 WININET!CSocket::ReceiveCompletion+0x00000084
6c264e8f WININET!CWxSocket::IoCompletionCallback+0x0000006f
74a85c4a KERNELBASE!BasepTpIoCallback+0x0000003a
770cebbf ntdll!TppIopExecuteCallback+0x0000016f
770cd8d6 ntdll!TppWorkerThread+0x00000866
7700dea4 KERNEL32!BaseThreadInitThunk+0x00000024
770e055e ntdll!__RtlUserThreadStart+0x0000002b
770e052d ntdll!_RtlUserThreadStart+0x0000001b
3:065> kn 0x32
# ChildEBP RetAddr
00 0885f8e4 6c2982ec WININET!CHttpHeaderParser::ParseStatusLine+0x80
01 0885f928 6c297fef WININET!HTTP_REQUEST_HANDLE_OBJECT::_ParseResponseLine+0x71
02 0885f964 6c292bc8 WININET!HTTP_REQUEST_HANDLE_OBJECT::UpdateResponseHeaders+0x4f
03 0885f9d4 6c2deb2c WININET!HTTP_REQUEST_HANDLE_OBJECT::ReceiveResponse_Fsm+0xc8
04 0885f9ec 6c291240 WININET!CFsm_ReceiveResponse::RunSM+0x3c
05 0885fa40 6c291fdb WININET!CFsm::Run+0x530
06 0885fb0c 6c265054 WININET!CFsm::RunWorkItem+0x25b
07 0885fb28 6c264e8f WININET!CSocket::ReceiveCompletion+0x84
08 0885fb64 74a85c4a WININET!CWxSocket::IoCompletionCallback+0x6f
09 0885fb8c 770cebbf KERNELBASE!BasepTpIoCallback+0x3a
0a 0885fc78 770cd8d6 ntdll!TppIopExecuteCallback+0x16f
0b 0885fe84 7700dea4 ntdll!TppWorkerThread+0x866
0c 0885fe98 770e055e KERNEL32!BaseThreadInitThunk+0x24
0d 0885fee0 770e052d ntdll!__RtlUserThreadStart+0x2b
0e 0885fef0 00000000 ntdll!_RtlUserThreadStart+0x1b
3:065>