Analysis
-
max time kernel
40s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 17:14
Static task
static1
Behavioral task
behavioral1
Sample
MainC-razy.exe
Resource
win7-20240611-en
General
-
Target
MainC-razy.exe
-
Size
18.6MB
-
MD5
ee0856acfae5be20b38ea85315720cb2
-
SHA1
e45a3bfae79c9bda70479f5d3addad4ceea44423
-
SHA256
58337239098c01aca77aa8b4e7768ff2865400b802f3f3381fc38f8f5e30c70c
-
SHA512
7c79509309e229bb66ffcfb22853ed8a13fccac4123decb81898ee55f67643df1cb8dfe92a7a49094b3984b694a47fcb512d5d4d54e7f04440c076d5149f9e16
-
SSDEEP
393216:eEjNaf4lx6fuKIx5ndL01+l+uq+VvbW+eGQRXMTozGxu8C0ibftJXMu9:LjNu4lk3IxRR01+l+uqgvbW+e5Raoztx
Malware Config
Signatures
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
main_protected.exemain_protected.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ main_protected.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ main_protected.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
main_protected.exemain_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion main_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion main_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion main_protected.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion main_protected.exe -
Executes dropped EXE 2 IoCs
Processes:
main_protected.exemain_protected.exepid process 4272 main_protected.exe 1884 main_protected.exe -
Loads dropped DLL 18 IoCs
Processes:
main_protected.exepid process 1884 main_protected.exe 1884 main_protected.exe 1884 main_protected.exe 1884 main_protected.exe 1884 main_protected.exe 1884 main_protected.exe 1884 main_protected.exe 1884 main_protected.exe 1884 main_protected.exe 1884 main_protected.exe 1884 main_protected.exe 1884 main_protected.exe 1884 main_protected.exe 1884 main_protected.exe 1884 main_protected.exe 1884 main_protected.exe 1884 main_protected.exe 1884 main_protected.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\MainC-razy_cfeef892-8d4c-4cb8-9186-f479b4dd11f9\main_protected.exe themida behavioral2/memory/4272-13-0x0000000140000000-0x0000000140A88000-memory.dmp themida behavioral2/memory/4272-15-0x0000000140000000-0x0000000140A88000-memory.dmp themida behavioral2/memory/4272-16-0x0000000140000000-0x0000000140A88000-memory.dmp themida behavioral2/memory/1884-50-0x0000000140000000-0x0000000140A88000-memory.dmp themida behavioral2/memory/1884-51-0x0000000140000000-0x0000000140A88000-memory.dmp themida behavioral2/memory/1884-52-0x0000000140000000-0x0000000140A88000-memory.dmp themida behavioral2/memory/4272-93-0x0000000140000000-0x0000000140A88000-memory.dmp themida behavioral2/memory/1884-94-0x0000000140000000-0x0000000140A88000-memory.dmp themida behavioral2/memory/4272-115-0x0000000140000000-0x0000000140A88000-memory.dmp themida -
Processes:
main_protected.exemain_protected.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA main_protected.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA main_protected.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
main_protected.exemain_protected.exepid process 4272 main_protected.exe 1884 main_protected.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
TASKLIST.exedescription pid process Token: SeDebugPrivilege 4780 TASKLIST.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
MainC-razy.exemain_protected.exemain_protected.execmd.exedescription pid process target process PID 3664 wrote to memory of 4272 3664 MainC-razy.exe main_protected.exe PID 3664 wrote to memory of 4272 3664 MainC-razy.exe main_protected.exe PID 4272 wrote to memory of 1884 4272 main_protected.exe main_protected.exe PID 4272 wrote to memory of 1884 4272 main_protected.exe main_protected.exe PID 1884 wrote to memory of 2904 1884 main_protected.exe cmd.exe PID 1884 wrote to memory of 2904 1884 main_protected.exe cmd.exe PID 1884 wrote to memory of 3600 1884 main_protected.exe cmd.exe PID 1884 wrote to memory of 3600 1884 main_protected.exe cmd.exe PID 1884 wrote to memory of 2108 1884 main_protected.exe cmd.exe PID 1884 wrote to memory of 2108 1884 main_protected.exe cmd.exe PID 1884 wrote to memory of 3116 1884 main_protected.exe cmd.exe PID 1884 wrote to memory of 3116 1884 main_protected.exe cmd.exe PID 1884 wrote to memory of 4940 1884 main_protected.exe cmd.exe PID 1884 wrote to memory of 4940 1884 main_protected.exe cmd.exe PID 1884 wrote to memory of 988 1884 main_protected.exe cmd.exe PID 1884 wrote to memory of 988 1884 main_protected.exe cmd.exe PID 1884 wrote to memory of 4780 1884 main_protected.exe TASKLIST.exe PID 1884 wrote to memory of 4780 1884 main_protected.exe TASKLIST.exe PID 1884 wrote to memory of 2836 1884 main_protected.exe cmd.exe PID 1884 wrote to memory of 2836 1884 main_protected.exe cmd.exe PID 2836 wrote to memory of 3632 2836 cmd.exe bcdedit.exe PID 2836 wrote to memory of 3632 2836 cmd.exe bcdedit.exe PID 1884 wrote to memory of 4644 1884 main_protected.exe cmd.exe PID 1884 wrote to memory of 4644 1884 main_protected.exe cmd.exe PID 1884 wrote to memory of 3300 1884 main_protected.exe cmd.exe PID 1884 wrote to memory of 3300 1884 main_protected.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\MainC-razy.exe"C:\Users\Admin\AppData\Local\Temp\MainC-razy.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MainC-razy_cfeef892-8d4c-4cb8-9186-f479b4dd11f9\main_protected.exe"C:\Users\Admin\AppData\Local\Temp\MainC-razy_cfeef892-8d4c-4cb8-9186-f479b4dd11f9\main_protected.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MainC-razy_cfeef892-8d4c-4cb8-9186-f479b4dd11f9\main_protected.exe"C:\Users\Admin\AppData\Local\Temp\MainC-razy_cfeef892-8d4c-4cb8-9186-f479b4dd11f9\main_protected.exe"3⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c title C-Razy Spoofer / VERSION 3.04⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c4⤵
-
C:\Windows\SYSTEM32\TASKLIST.exeTASKLIST /FI "imagename eq gta_sa.exe"4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit5⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls4⤵
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c4⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\MainC-razy_cfeef892-8d4c-4cb8-9186-f479b4dd11f9\main_protected.exeFilesize
15.3MB
MD5ef0843783dc297098f2687448afc278d
SHA1ba1a2683e11433645e13f70ab591c80e8d2acbf9
SHA256539377e8badeb22556d54e62dcb043cc9e7cb938322cffbdecf3546a0e9a388c
SHA51205348f7cfe0682454042472f3e85d66e3359073d74d988cc0f0e6d2ca1cb434f0d0bf35f0a8ef203f45daf707741961a845c7919baec3fe446024bd7249d4adc
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\VCRUNTIME140.dllFilesize
116KB
MD5be8dbe2dc77ebe7f88f910c61aec691a
SHA1a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA2564d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
SHA5120da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\_brotli.cp312-win_amd64.pydFilesize
802KB
MD59ad5bb6f92ee2cfd29dde8dd4da99eb7
SHA130a8309938c501b336fd3947de46c03f1bb19dc8
SHA256788acbfd0edd6ca3ef3e97a9487eeaea86515642c71cb11bbcf25721e6573ec8
SHA512a166abcb834d6c9d6b25807adddd25775d81e2951e1bc3e9849d8ae868dedf2e1ee1b6b4b288ddfbd88a63a6fa624e2d6090aa71ded9b90c2d8cbf2d9524fdbf
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\_bz2.pydFilesize
82KB
MD590f58f625a6655f80c35532a087a0319
SHA1d4a7834201bd796dc786b0eb923f8ec5d60f719b
SHA256bd8621fcc901fa1de3961d93184f61ea71068c436794af2a4449738ccf949946
SHA512b5bb1ecc195700ad7bea5b025503edd3770b1f845f9beee4b067235c4e63496d6e0b19bdd2a42a1b6591d1131a2dc9f627b2ae8036e294300bb6983ecd644dc8
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\_cffi_backend.cp312-win_amd64.pydFilesize
178KB
MD50572b13646141d0b1a5718e35549577c
SHA1eeb40363c1f456c1c612d3c7e4923210eae4cdf7
SHA256d8a76d1e31bbd62a482dea9115fc1a109cb39af4cf6d1323409175f3c93113a7
SHA51267c28432ca8b389acc26e47eb8c4977fddd4af9214819f89df07fecbc8ed750d5f35807a1b195508dd1d77e2a7a9d7265049dcfbfe7665a7fd1ba45da1e4e842
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\_ctypes.pydFilesize
122KB
MD5452305c8c5fda12f082834c3120db10a
SHA19bab7b3fd85b3c0f2bedc3c5adb68b2579daa6e7
SHA256543ce9d6dc3693362271a2c6e7d7fc07ad75327e0b0322301dd29886467b0b0e
SHA5123d52afdbc8da74262475abc8f81415a0c368be70dbf5b2bd87c9c29ca3d14c44770a5b8b2e7c082f3ece0fd2ba1f98348a04b106a48d479fa6bd062712be8f7c
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\_decimal.pydFilesize
247KB
MD5f78f9855d2a7ca940b6be51d68b80bf2
SHA1fd8af3dbd7b0ea3de2274517c74186cb7cd81a05
SHA256d4ae192bbd4627fc9487a2c1cd9869d1b461c20cfd338194e87f5cf882bbed12
SHA5126b68c434a6f8c436d890d3c1229d332bd878e5777c421799f84d79679e998b95d2d4a013b09f50c5de4c6a85fcceb796f3c486e36a10cbac509a0da8d8102b18
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\_hashlib.pydFilesize
64KB
MD58baeb2bd6e52ba38f445ef71ef43a6b8
SHA14132f9cd06343ef8b5b60dc8a62be049aa3270c2
SHA2566c50c9801a5caf0bb52b384f9a0d5a4aa182ca835f293a39e8999cf6edf2f087
SHA512804a4e19ea622646cea9e0f8c1e284b7f2d02f3620199fa6930dbdadc654fa137c1e12757f87c3a1a71ceff9244aa2f598ee70d345469ca32a0400563fe3aa65
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\_lzma.pydFilesize
155KB
MD5cf8de1137f36141afd9ff7c52a3264ee
SHA1afde95a1d7a545d913387624ef48c60f23cf4a3f
SHA25622d10e2d6ad3e3ed3c49eb79ab69a81aaa9d16aeca7f948da2fe80877f106c16
SHA512821985ff5bc421bd16b2fa5f77f1f4bf8472d0d1564bc5768e4dbe866ec52865a98356bb3ef23a380058acd0a25cd5a40a1e0dae479f15863e48c4482c89a03f
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\_queue.pydFilesize
31KB
MD55aa4b057ba2331eed6b4b30f4b3e0d52
SHA16b9db113c2882743984c3d8b70ec49fc4a136c23
SHA256d43dca0e00c3c11329b68177e967cf5240495c4786f5afa76ac4f267c3a5cdb9
SHA512aa5aa3285ea5c177eca055949c5f550dbd2d2699202a29efe2077213cbc95fff2a36d99eecce249ac04d95baf149b3d8c557a67fc39ead3229f0b329e83447b7
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\_socket.pydFilesize
81KB
MD5439b3ad279befa65bb40ecebddd6228b
SHA1d3ea91ae7cad9e1ebec11c5d0517132bbc14491e
SHA25624017d664af20ee3b89514539345caac83eca34825fcf066a23e8a4c99f73e6d
SHA512a335e1963bb21b34b21aef6b0b14ba8908a5343b88f65294618e029e3d4d0143ea978a5fd76d2df13a918ffab1e2d7143f5a1a91a35e0cc1145809b15af273bd
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\_ssl.pydFilesize
173KB
MD56774d6fb8b9e7025254148dc32c49f47
SHA1212e232da95ec8473eb0304cf89a5baf29020137
SHA2562b6f1b1ac47cb7878b62e8d6bb587052f86ca8145b05a261e855305b9ca3d36c
SHA5125d9247dce96599160045962af86fc9e5439f66a7e8d15d1d00726ec1b3b49d9dd172d667380d644d05cb18e45a5419c2594b4bcf5a16ea01542ae4d7d9a05c6e
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\base_library.zipFilesize
1.3MB
MD5c55ad50db3ba71c56c6fb55e7b116550
SHA16699e6d9c6625634641bcabe01ed2e34eb923ded
SHA256e599cf77eb7d4e4789d50f59ffb858389f3494438517e537e759bdb3e51c2a6b
SHA512402de5d1ddfea29b3fb2bfcb1766afeaa6ea4a37a9ca24e94ed4b1312172dd7795b23c78156091e6a81dfe1c76363c0aea35d0d372b268daaa79d7bef719eb02
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\charset_normalizer\md.cp312-win_amd64.pydFilesize
10KB
MD5d9e0217a89d9b9d1d778f7e197e0c191
SHA1ec692661fcc0b89e0c3bde1773a6168d285b4f0d
SHA256ecf12e2c0a00c0ed4e2343ea956d78eed55e5a36ba49773633b2dfe7b04335c0
SHA5123b788ac88c1f2d682c1721c61d223a529697c7e43280686b914467b3b39e7d6debaff4c0e2f42e9dddb28b522f37cb5a3011e91c66d911609c63509f9228133d
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\charset_normalizer\md__mypyc.cp312-win_amd64.pydFilesize
120KB
MD5bf9a9da1cf3c98346002648c3eae6dcf
SHA1db16c09fdc1722631a7a9c465bfe173d94eb5d8b
SHA2564107b1d6f11d842074a9f21323290bbe97e8eed4aa778fbc348ee09cc4fa4637
SHA5127371407d12e632fc8fb031393838d36e6a1fe1e978ced36ff750d84e183cde6dd20f75074f4597742c9f8d6f87af12794c589d596a81b920c6c62ee2ba2e5654
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\libcrypto-3.dllFilesize
4.9MB
MD551e8a5281c2092e45d8c97fbdbf39560
SHA1c499c810ed83aaadce3b267807e593ec6b121211
SHA2562a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a
SHA51298b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\libffi-8.dllFilesize
38KB
MD50f8e4992ca92baaf54cc0b43aaccce21
SHA1c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA256eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
SHA5126e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\libssl-3.dllFilesize
771KB
MD5bfc834bb2310ddf01be9ad9cff7c2a41
SHA1fb1d601b4fcb29ff1b13b0d2ed7119bd0472205c
SHA25641ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1
SHA5126af473c7c0997f2847ebe7cee8ef67cd682dee41720d4f268964330b449ba71398fda8954524f9a97cc4cdf9893b8bdc7a1cf40e9e45a73f4f35a37f31c6a9c3
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\python3.dllFilesize
66KB
MD54038af0427bce296ca8f3e98591e0723
SHA1b2975225721959d87996454d049e6d878994cbf2
SHA256a5bb3eb6fdfd23e0d8b2e4bccd6016290c013389e06daae6cb83964fa69e2a4f
SHA512db762442c6355512625b36f112eca6923875d10aaf6476d79dc6f6ffc9114e8c7757ac91dbcd1fb00014122bc7f656115160cf5d62fa7fa1ba70bc71346c1ad3
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\python312.dllFilesize
6.7MB
MD548ebfefa21b480a9b0dbfc3364e1d066
SHA1b44a3a9b8c585b30897ddc2e4249dfcfd07b700a
SHA2560cc4e557972488eb99ea4aeb3d29f3ade974ef3bcd47c211911489a189a0b6f2
SHA5124e6194f1c55b82ee41743b35d749f5d92a955b219decacf9f1396d983e0f92ae02089c7f84a2b8296a3062afa3f9c220da9b7cd9ed01b3315ea4a953b4ecc6ce
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\select.pydFilesize
29KB
MD5e1604afe8244e1ce4c316c64ea3aa173
SHA199704d2c0fa2687997381b65ff3b1b7194220a73
SHA25674cca85600e7c17ea6532b54842e26d3cae9181287cdf5a4a3c50af4dab785e5
SHA5127bf35b1a9da9f1660f238c2959b3693b7d9d2da40cf42c6f9eba2164b73047340d0adff8995049a2fe14e149eba05a5974eee153badd9e8450f961207f0b3d42
-
C:\Users\Admin\AppData\Local\Temp\_MEI42722\unicodedata.pydFilesize
1.1MB
MD5fc47b9e23ddf2c128e3569a622868dbe
SHA12814643b70847b496cbda990f6442d8ff4f0cb09
SHA2562a50d629895a05b10a262acf333e7a4a31db5cb035b70d14d1a4be1c3e27d309
SHA5127c08683820498fdff5f1703db4ad94ad15f2aa877d044eddc4b54d90e7dc162f48b22828cd577c9bb1b56f7c11f777f9785a9da1867bf8c0f2b6e75dc57c3f53
-
memory/1884-52-0x0000000140000000-0x0000000140A88000-memory.dmpFilesize
10.5MB
-
memory/1884-53-0x00007FF9F6690000-0x00007FF9F6885000-memory.dmpFilesize
2.0MB
-
memory/1884-51-0x0000000140000000-0x0000000140A88000-memory.dmpFilesize
10.5MB
-
memory/1884-50-0x0000000140000000-0x0000000140A88000-memory.dmpFilesize
10.5MB
-
memory/1884-103-0x00007FF9F6690000-0x00007FF9F6885000-memory.dmpFilesize
2.0MB
-
memory/1884-99-0x00007FF9F6690000-0x00007FF9F6885000-memory.dmpFilesize
2.0MB
-
memory/1884-94-0x0000000140000000-0x0000000140A88000-memory.dmpFilesize
10.5MB
-
memory/3664-0-0x00000000752AE000-0x00000000752AF000-memory.dmpFilesize
4KB
-
memory/3664-95-0x00000000752AE000-0x00000000752AF000-memory.dmpFilesize
4KB
-
memory/3664-3-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/3664-122-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/3664-2-0x0000000002BA0000-0x0000000002BC4000-memory.dmpFilesize
144KB
-
memory/3664-1-0x0000000000760000-0x00000000007AA000-memory.dmpFilesize
296KB
-
memory/3664-96-0x00000000752A0000-0x0000000075A50000-memory.dmpFilesize
7.7MB
-
memory/3664-4-0x00000000057E0000-0x0000000005D84000-memory.dmpFilesize
5.6MB
-
memory/4272-17-0x00007FF9F6730000-0x00007FF9F6732000-memory.dmpFilesize
8KB
-
memory/4272-93-0x0000000140000000-0x0000000140A88000-memory.dmpFilesize
10.5MB
-
memory/4272-15-0x0000000140000000-0x0000000140A88000-memory.dmpFilesize
10.5MB
-
memory/4272-16-0x0000000140000000-0x0000000140A88000-memory.dmpFilesize
10.5MB
-
memory/4272-115-0x0000000140000000-0x0000000140A88000-memory.dmpFilesize
10.5MB
-
memory/4272-13-0x0000000140000000-0x0000000140A88000-memory.dmpFilesize
10.5MB