Analysis
-
max time kernel
148s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
29-03-2024 23:30
General
-
Target
UnbrandedSpoofer.exe
-
Size
1.6MB
-
MD5
c7a28f9dc387785be826907632461b2d
-
SHA1
9e074dcc5b706b6eabc13f966bc6775e0d7265eb
-
SHA256
74f9c1d6ee1ef99a55dea1c42b26af37dc580f5c4cbd80f99d74c30771816bc5
-
SHA512
9b3838eb21c86a24722eab1fc181dc36183a2435e26d6a7b12aed062b9955a77f29f7fcbba08e8c2ca6b99a1d625819a6cf03206454444126ce6fcbaf921cbd1
-
SSDEEP
24576:uITMvRFhRRbNWoCfkYSEH3OqtwIuXU7KdR9HNGo8fGXjMq:uITYbNbNWo4kSH3OqtwI1KxHNGo+GY
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
-
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\UnbrandedSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\UnbrandedSpoofer.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"5⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"6⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"7⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"8⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"9⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"10⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"11⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"12⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"13⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"14⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"15⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"16⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"17⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"18⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"19⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"20⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"21⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"22⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"23⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"24⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"25⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"26⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"27⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"28⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"29⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"30⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"31⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"32⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"33⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"34⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"35⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"36⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"37⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"38⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"39⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"40⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"41⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"42⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"43⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"44⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"45⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"46⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"47⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"48⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"49⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"50⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"51⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"52⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"53⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"54⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"55⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"56⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"57⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"58⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"59⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"60⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"61⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"62⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"63⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"64⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"65⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"66⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exe"C:\Users\Admin\AppData\Local\Temp\unbranded.exe"67⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\unbranded.exe.logFilesize
654B
MD52ff39f6c7249774be85fd60a8f9a245e
SHA1684ff36b31aedc1e587c8496c02722c6698c1c4e
SHA256e1b91642d85d98124a6a31f710e137ab7fd90dec30e74a05ab7fcf3b7887dced
SHA5121d7e8b92ef4afd463d62cfa7e8b9d1799db5bf2a263d3cd7840df2e0a1323d24eb595b5f8eb615c6cb15f9e3a7b4fc99f8dd6a3d34479222e966ec708998aed1
-
C:\Users\Admin\AppData\Local\Temp\Guna.UI2.dllFilesize
2.1MB
MD5c19e9e6a4bc1b668d19505a0437e7f7e
SHA173be712aef4baa6e9dabfc237b5c039f62a847fa
SHA2569ac8b65e5c13292a8e564187c1e7446adc4230228b669383bd7b07035ab99a82
SHA512b6cd0af436459f35a97db2d928120c53d3691533b01e4f0e8b382f2bd81d9a9a2c57e5e2aa6ade9d6a1746d5c4b2ef6c88d3a0cf519424b34445d0d30aab61de
-
C:\Users\Admin\AppData\Local\Temp\unbranded.exeFilesize
819KB
MD54fcbb8637f75b3a58b40f0ad82db5199
SHA18aca063827cea15bd2bf91e67805bc64728cf2dc
SHA256bd11cdd61ae97b3998c3a6e174db9fe042f7c8c2de4939baecc9233f1b3c500c
SHA512e8e8066ccc6e5870cfac9ae941e5c07714c66805a119e4a64f2cab49acf8c775cbafb21316ad64b74258da69776a6c4876d85fe5258d2d9c32aa73fd542bb721
-
memory/412-25-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/412-31-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/412-27-0x000000001B830000-0x000000001B840000-memory.dmpFilesize
64KB
-
memory/1316-75-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/1316-76-0x000000001B600000-0x000000001B610000-memory.dmpFilesize
64KB
-
memory/1316-80-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/1484-81-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/1484-86-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/1484-82-0x000000001B9D0000-0x000000001B9E0000-memory.dmpFilesize
64KB
-
memory/1868-104-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/1868-99-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/1868-101-0x000000001BA90000-0x000000001BAA0000-memory.dmpFilesize
64KB
-
memory/2412-111-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/2412-112-0x000000001B090000-0x000000001B0A0000-memory.dmpFilesize
64KB
-
memory/2412-116-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/3272-94-0x0000000002D80000-0x0000000002D90000-memory.dmpFilesize
64KB
-
memory/3272-92-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/3272-98-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/3392-56-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/3392-61-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/3392-57-0x0000000002D20000-0x0000000002D30000-memory.dmpFilesize
64KB
-
memory/3492-70-0x000000001B410000-0x000000001B420000-memory.dmpFilesize
64KB
-
memory/3492-74-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/3492-69-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/3544-128-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/3544-50-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/3544-124-0x00000000008F0000-0x0000000000900000-memory.dmpFilesize
64KB
-
memory/3544-123-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/3544-44-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/3544-45-0x0000000001580000-0x0000000001590000-memory.dmpFilesize
64KB
-
memory/3560-32-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/3560-33-0x000000001B030000-0x000000001B040000-memory.dmpFilesize
64KB
-
memory/3560-37-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/3628-136-0x000000001BEF0000-0x000000001BF00000-memory.dmpFilesize
64KB
-
memory/3628-135-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/3680-129-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/3680-130-0x000000001BBF0000-0x000000001BC00000-memory.dmpFilesize
64KB
-
memory/3680-134-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/4284-51-0x0000000001030000-0x0000000001040000-memory.dmpFilesize
64KB
-
memory/4284-55-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/4284-49-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/4308-93-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/4308-87-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/4308-88-0x000000001B840000-0x000000001B850000-memory.dmpFilesize
64KB
-
memory/4344-0-0x0000000000810000-0x00000000009AA000-memory.dmpFilesize
1.6MB
-
memory/4344-1-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/4344-16-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/4344-2-0x000000001B830000-0x000000001B840000-memory.dmpFilesize
64KB
-
memory/4428-63-0x000000001B9A0000-0x000000001B9B0000-memory.dmpFilesize
64KB
-
memory/4428-67-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/4428-62-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/4820-18-0x0000000000FC0000-0x0000000001094000-memory.dmpFilesize
848KB
-
memory/4820-17-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/4820-19-0x000000001BE00000-0x000000001BE10000-memory.dmpFilesize
64KB
-
memory/4820-26-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/4840-122-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/4840-118-0x00000000022E0000-0x00000000022F0000-memory.dmpFilesize
64KB
-
memory/4840-117-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/4964-38-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/4964-39-0x000000001B220000-0x000000001B230000-memory.dmpFilesize
64KB
-
memory/4964-43-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/5108-110-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB
-
memory/5108-106-0x0000000002830000-0x0000000002840000-memory.dmpFilesize
64KB
-
memory/5108-105-0x00007FFE2D4D0000-0x00007FFE2DF91000-memory.dmpFilesize
10.8MB