Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

19/08/2024, 01:52

240819-caeacaxgkh 7

19/08/2024, 01:49

240819-b8t8saxfma 7

Analysis

  • max time kernel
    131s
  • max time network
    118s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19/08/2024, 01:52

General

  • Target

    0x Flooder V2.exe

  • Size

    31.7MB

  • MD5

    62b1ce06a2603f12ad9ff5c666894928

  • SHA1

    810ab55925e8811d426b69b0d57f368c88656a0a

  • SHA256

    e7250b90ea08da24b25990b911bcb4b0a54e64e7dfff33992b996cce5b3a6f57

  • SHA512

    082ce87fce5e49038991e96a3482a450135101f070127f8973d90c0c575e36e1f42b1df599b190d5ab2232ea091429a079de8b0717f23488bfca962147ab597e

  • SSDEEP

    786432:IIhvsWmek9kX3wpLk5lyuQyrI9BoVTiJUt4qIt7GiAQHcJwksoto60:IIiWmhKMLkvQFBAT8srOGiB8JZDt90

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 60 IoCs
  • Embeds OpenSSL 1 IoCs

    Embeds OpenSSL, may be used to circumvent TLS interception.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x Flooder V2.exe
    "C:\Users\Admin\AppData\Local\Temp\0x Flooder V2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3992
    • C:\Users\Admin\AppData\Local\Temp\onefile_3992_133685059876146390\main1.exe
      "C:\Users\Admin\AppData\Local\Temp\0x Flooder V2.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:3864
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c "ver"
        3⤵
          PID:2820
        • C:\Windows\System32\Wbem\wmic.exe
          wmic csproduct get uuid
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1008
        • C:\Windows\System32\Wbem\wmic.exe
          wmic csproduct get uuid
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:840
        • C:\Windows\System32\Wbem\wmic.exe
          wmic csproduct get uuid
          3⤵
            PID:2944
          • C:\Windows\System32\Wbem\wmic.exe
            wmic csproduct get uuid
            3⤵
              PID:3984
            • C:\Windows\System32\Wbem\wmic.exe
              wmic csproduct get uuid
              3⤵
                PID:4736
              • C:\Windows\System32\Wbem\wmic.exe
                wmic csproduct get uuid
                3⤵
                  PID:1356
                • C:\Windows\System32\Wbem\wmic.exe
                  wmic csproduct get uuid
                  3⤵
                    PID:5072
                  • C:\Windows\System32\Wbem\wmic.exe
                    wmic csproduct get uuid
                    3⤵
                      PID:3856
                    • C:\Windows\System32\Wbem\wmic.exe
                      wmic csproduct get uuid
                      3⤵
                        PID:3152
                      • C:\Windows\System32\Wbem\wmic.exe
                        wmic csproduct get uuid
                        3⤵
                          PID:2992
                        • C:\Windows\System32\Wbem\wmic.exe
                          wmic csproduct get uuid
                          3⤵
                            PID:5028

                      Network

                      MITRE ATT&CK Matrix

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_bz2.pyd

                        Filesize

                        82KB

                        MD5

                        afaa11704fda2ed686389080b6ffcb11

                        SHA1

                        9a9c83546c2e3b3ccf823e944d5fd07d22318a1b

                        SHA256

                        ab34b804da5b8e814b2178754d095a4e8aead77eefd3668da188769392cdb5f4

                        SHA512

                        de23bb50f1d416cf4716a5d25fe12f4b66e6226bb39e964d0de0fef1724d35b48c681809589c731d3061a97c62b4dc7b9b7dfe2978f196f2d82ccce286be8a2a

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_decimal.pyd

                        Filesize

                        247KB

                        MD5

                        33f721f1cbb413cd4f26fe0ed4a597e7

                        SHA1

                        476d5fab7b2db3f53b90b7cc6099d5541e72883e

                        SHA256

                        080d0fbbff68d17b670110c95210347be7b8ab7c385f956f123a66dc2f434ab3

                        SHA512

                        8fbc82af0fe063c4eb8fdefae5650924ac607be54b81c4d51064ca720bb85bfc9e1705ba93df5be6add156a6b360dd1f700618862877e28de7c13e21b470b507

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_hashlib.pyd

                        Filesize

                        63KB

                        MD5

                        534902be1d8a57974efd025aff4f11ef

                        SHA1

                        1179c6153dc52f72c29fe1591dc9a889c2e229e9

                        SHA256

                        30adfb86513282e59d7e27968e1ff6686e43b8559994a50c17be66d0789f82b3

                        SHA512

                        7f0cdcf8576faf30fc8104b9bc9586d85ad50b7803074a7bcaa192eed05b1e2bd988a91873554fb63f204fcad86c667e95755c5ff13c43f96dc334ef3ea37240

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_lzma.pyd

                        Filesize

                        155KB

                        MD5

                        2ae2464bfcc442083424bc05ed9be7d2

                        SHA1

                        f64b100b59713e51d90d2e016b1fe573b6507b5d

                        SHA256

                        64ba475a28781dca81180a1b8722a81893704f8d8fac0b022c846fdcf95b15b9

                        SHA512

                        6c3acd3dcae733452ad68477417693af64a7d79558e8ec9f0581289903c2412e2f29195b90e396bfdcd765337a6dea9632e4b8d936ac39b1351cd593cb12ce27

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_overlapped.pyd

                        Filesize

                        50KB

                        MD5

                        830e3bb082017041c800814687d2d5dc

                        SHA1

                        1fe9b51e09b8dbb5080637bdf4c8594f309ae603

                        SHA256

                        9215dbd5b09ed064f6e57fca57e16880566bd30f93bbdb15f45fa07a779c2ed4

                        SHA512

                        68286fd6e274c10442361e29806d8b49f609a243ae693d92a6936c7e25d771fe4d9c09adb345948e67165a3158453140b517743b6c90286f78e5923988f15a02

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_queue.pyd

                        Filesize

                        31KB

                        MD5

                        dbd3c2c0a348a44a96d76100690c606d

                        SHA1

                        04e901eac1161255adb16155459ac50f124b30a6

                        SHA256

                        2bfd8459ba01c741d676f79ee96802fb2c29cb30f50301d67fde8bbce8e7e7d4

                        SHA512

                        99fee97c272bfff4515407d588b2761af7be39a83be070e01128fba71ff75404fbad6352bcdbe5465786ce86a6550f47b177d022ccb53f32f5a482db61bee3b4

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_socket.pyd

                        Filesize

                        77KB

                        MD5

                        11b7936a5bd929cc76ac3f4f137b5236

                        SHA1

                        09cb712fa43dc008eb5185481a5080997aff82ab

                        SHA256

                        8956b11c07d08d289425e7240b8fa37841a27c435617dbbd02bfe3f9405f422b

                        SHA512

                        7b050df283a0ad4295a5be47b99d7361f49a3cfd20691e201c5da5349a9eb8f5710ab3a26a66d194567539660ed227411485f4edf2269567a55a6b8ccfd71096

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_ssl.pyd

                        Filesize

                        172KB

                        MD5

                        0e9e6d6839d74ad40bb9f16cc6601b13

                        SHA1

                        6671039088793f4ba42f5bd4409c26b1283ceafa

                        SHA256

                        bca1f490c9f7ba25cbbb4b39785dda8aa651123e22d4e7edc299b218c8157a81

                        SHA512

                        cb8742ae5db83487c21ba17d9efaca736df49f8f3c4a72355ede119717b83e0b4c6d94bd1c75a992abaf4ab89502a805f81b2529e85fd6a656600d6e7b0c90f5

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\_uuid.pyd

                        Filesize

                        24KB

                        MD5

                        4ba1fcf5f12ebc514e86d7e02901b3c3

                        SHA1

                        0fd88df618da41cdeb4afdaded039932a66ce5f6

                        SHA256

                        51cb69267f77c094d687af5b80c560eaf325d0990304baf20242d477d8b156a1

                        SHA512

                        3601331a84a9dcf62bbdadfc5c273853acf229931e70f5ff6f541d5f23474373f9366c606534ffdbf73c1044e98e464877b395f2e285821f264a57cd90021705

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\aiohttp\_helpers.pyd

                        Filesize

                        53KB

                        MD5

                        61a41b3f6b3d2c23314f0e36efcfe981

                        SHA1

                        70d8a2fe7ed7817086f1365b52157548949fcabc

                        SHA256

                        dd1f5f5f8d3f8f8429e8fd03195a77ef4f310d0a7a4e7ba96553f534ef1dfb7d

                        SHA512

                        84cb56d8b7acb62dfd159a7b8a67af929489641b2e81ab40f024499069f6c5ffc2f0981a4b69fb8c5229c0ab9bb9834c247f207fccfab522ffb67213c1a61fc9

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\aiohttp\_http_parser.pyd

                        Filesize

                        257KB

                        MD5

                        72195fdf9ac0f84ef2f9bc32fa718e8e

                        SHA1

                        e4fc88dd5dbaa33ece59847e76571092718f4238

                        SHA256

                        0a449f5051d1732feb4b8c2348e75047bbc38ce99e6f5b1a70cb24fcce50ed47

                        SHA512

                        310586a78cd70873485e00106497c4f7ba291f13a3fe9337b62300cb8bcb705c8158aa14f1deffdbf0b454e9ea10097158d06466e5ef1a72d72112765398585f

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\aiohttp\_http_writer.pyd

                        Filesize

                        48KB

                        MD5

                        c0ecc217f88b3d8dc7d88a9eb264e406

                        SHA1

                        e97e64c8d2187a56c0de63bee9606b09cb8fb143

                        SHA256

                        164ac6adfdaaccf251526dc8af6adaebfcf04746c9c524634e59afef53a1f82b

                        SHA512

                        de76b89bc8512df6fedf4247b1ac32398fb4a80ca2c06ebea349ac22b95528d7405e25c962c20f472af5972c52a28d023f187a6daa1a2b5fedc7d1ae17993ec1

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\certifi\cacert.pem

                        Filesize

                        287KB

                        MD5

                        2a6bef11d1f4672f86d3321b38f81220

                        SHA1

                        b4146c66e7e24312882d33b16b2ee140cb764b0e

                        SHA256

                        1605d0d39c5e25d67e7838da6a17dcf2e8c6cfa79030e8fb0318e35f5495493c

                        SHA512

                        500dfff929d803b0121796e8c1a30bdfcb149318a4a4de460451e093e4cbd568cd12ab20d0294e0bfa7efbd001de968cca4c61072218441d4fa7fd9edf7236d9

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\charset_normalizer\md.pyd

                        Filesize

                        10KB

                        MD5

                        723ec2e1404ae1047c3ef860b9840c29

                        SHA1

                        8fc869b92863fb6d2758019dd01edbef2a9a100a

                        SHA256

                        790a11aa270523c2efa6021ce4f994c3c5a67e8eaaaf02074d5308420b68bd94

                        SHA512

                        2e323ae5b816adde7aaa14398f1fdb3efe15a19df3735a604a7db6cadc22b753046eab242e0f1fbcd3310a8fbb59ff49865827d242baf21f44fd994c3ac9a878

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\libcrypto-3.dll

                        Filesize

                        4.9MB

                        MD5

                        51e8a5281c2092e45d8c97fbdbf39560

                        SHA1

                        c499c810ed83aaadce3b267807e593ec6b121211

                        SHA256

                        2a234b5aa20c3faecf725bbb54fb33f3d94543f78fa7045408e905593e49960a

                        SHA512

                        98b91719b0975cb38d3b3c7b6f820d184ef1b64d38ad8515be0b8b07730e2272376b9e51631fe9efd9b8a1709fea214cf3f77b34eeb9fd282eb09e395120e7cb

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\multidict\_multidict.pyd

                        Filesize

                        45KB

                        MD5

                        53c003dec693f83c57f326b6df5d5f05

                        SHA1

                        6977ebcbf74a039501825697021c504d7cc63928

                        SHA256

                        32555defdb044714dbaaec281820fa7a0c226545d40561b905294d2e0bdba102

                        SHA512

                        2c4b9dff022d25906981d52f68a9bda8e7840597bea6cbea9bc8036392dea56fbecaedcd1b9f6547074c28b018266e424ca0ae8e66bad947544a8571f83fd2f4

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\nacl\_sodium.pyd

                        Filesize

                        340KB

                        MD5

                        9d1b8bad0e17e63b9d8e441cdc15baee

                        SHA1

                        0c5a62135b072d1951a9d6806b9eff7aa9c897a3

                        SHA256

                        d733c23c6a4b21625a4ff07f6562ba882bcbdb0f50826269419d8de0574f88cd

                        SHA512

                        49e7f6ab825d5047421641ed4618ff6cb2a8d22a8a4ae1bd8f2deefe7987d80c8e0acc72b950d02214f7b41dc4a42df73a7f5742ebc96670d1c5a28c47b97355

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\select.pyd

                        Filesize

                        29KB

                        MD5

                        0b55f18218f4c8f30105db9f179afb2c

                        SHA1

                        f1914831cf0a1af678970824f1c4438cc05f5587

                        SHA256

                        e7fe45baef9cee192c65fcfce1790ccb6f3f9b81e86df82c08f838e86275af02

                        SHA512

                        428ee25e99f882af5ad0dedf1ccdbeb1b4022ac286af23b209947a910bf02ae18a761f3152990c84397649702d8208fed269aa3e3a3c65770e21ee1eec064cc1

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\wrapt\_wrappers.pyd

                        Filesize

                        35KB

                        MD5

                        5f7ad86b16b165335478aa142366e932

                        SHA1

                        aa55cd0b0bd8f43c1a4c9837e884517a514483da

                        SHA256

                        2df2a0f1cbaa3e7378b1b36bc94dd1e351ea66143ee3f03677d5f15942c45146

                        SHA512

                        3ea6cb04c35f9ac5418ab22d25bccf5088fcf7ad0559625bca7a2864bad797c77e5730727a3c030f6799476785cec75841404e5f495cf9a394d3c99fce94da1d

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\yarl\_quoting_c.pyd

                        Filesize

                        93KB

                        MD5

                        3ccc89b98dab137bc5af9c1e62923829

                        SHA1

                        55d93e9782094925d80e4ce27d13a0a9761b7002

                        SHA256

                        40e91aaa369a5c171c0d30630707ae9bb64412fedf149aeecfa5707a2324f770

                        SHA512

                        4ebe427c75d83c019f8d378a030ae21e07decf30cd10623115eb0cc6ad7a689159e95c7fabac82ce82cea3720fae6c6faf712b600236dad039255884872eb6c0

                      • C:\Users\Admin\AppData\Local\Temp\ONEFIL~1\zstandard\backend_c.pyd

                        Filesize

                        512KB

                        MD5

                        dc08f04c9e03452764b4e228fc38c60b

                        SHA1

                        317bcc3f9c81e2fc81c86d5a24c59269a77e3824

                        SHA256

                        b990efbda8a50c49cd7fde5894f3c8f3715cb850f8cc4c10bc03fd92e310260f

                        SHA512

                        fbc24dd36af658cece54be14c1118af5fda4e7c5b99d22f99690a1fd625cc0e8aa41fd9accd1c74bb4b03d494b6c3571b24f2ee423aaae9a5ad50adc583c52f7

                      • C:\Users\Admin\AppData\Local\Temp\onefile_3992_133685059876146390\_asyncio.pyd

                        Filesize

                        63KB

                        MD5

                        806e47cb0146c81aeaa8bf3b55789801

                        SHA1

                        6ee2c47f892480846c98acea03915e744e24f217

                        SHA256

                        55cbeaa0a6d5678b4ff611b5166829b1a07b84b97e72e35263216703d98332ef

                        SHA512

                        a8090290c571cf94c0dc09c91156149c05d1883081cd5b0d69230b6ea8bc4052e518c00004b35964f5464c67e757e3993feeef980fa99ffb3e612b2384629ab3

                      • C:\Users\Admin\AppData\Local\Temp\onefile_3992_133685059876146390\_cffi_backend.pyd

                        Filesize

                        177KB

                        MD5

                        210def84bb2c35115a2b2ac25e3ffd8f

                        SHA1

                        0376b275c81c25d4df2be4789c875b31f106bd09

                        SHA256

                        59767b0918859beddf28a7d66a50431411ffd940c32b3e8347e6d938b60facdf

                        SHA512

                        cd5551eb7afd4645860c7edd7b0abd375ee6e1da934be21a6099879c8ee3812d57f2398cad28fbb6f75bba77471d9b32c96c7c1e9d3b4d26c7fc838745746c7f

                      • C:\Users\Admin\AppData\Local\Temp\onefile_3992_133685059876146390\aiohttp\_websocket.pyd

                        Filesize

                        35KB

                        MD5

                        b0a9a4a202d97af404285694ea62f36e

                        SHA1

                        9ad282704bb6ad49e5a48d18b04669b46c9ec13e

                        SHA256

                        b85f7c9bf23062be8d7b9e77cd54416fdb768ceafb114c1cdb19f8b349a9377c

                        SHA512

                        984e4521bf64ebc4f8d848fcc7cecc20c5d80a3daa53f59b936d14b09bec3334358665577badfb1e127d7696872daf0c29ee1dc7a0f909c60aec4059568fa274

                      • C:\Users\Admin\AppData\Local\Temp\onefile_3992_133685059876146390\charset_normalizer\md__mypyc.pyd

                        Filesize

                        116KB

                        MD5

                        9ea8098d31adb0f9d928759bdca39819

                        SHA1

                        e309c85c1c8e6ce049eea1f39bee654b9f98d7c5

                        SHA256

                        3d9893aa79efd13d81fcd614e9ef5fb6aad90569beeded5112de5ed5ac3cf753

                        SHA512

                        86af770f61c94dfbf074bcc4b11932bba2511caa83c223780112bda4ffb7986270dc2649d4d3ea78614dbce6f7468c8983a34966fc3f2de53055ac6b5059a707

                      • C:\Users\Admin\AppData\Local\Temp\onefile_3992_133685059876146390\cryptography\hazmat\bindings\_rust.pyd

                        Filesize

                        6.9MB

                        MD5

                        f918173fbdc6e75c93f64784f2c17050

                        SHA1

                        163ef51d4338b01c3bc03d6729f8e90ae39d8f04

                        SHA256

                        2c7a31dec06df4eec6b068a0b4b009c8f52ef34ace785c8b584408cb29ce28fd

                        SHA512

                        5405d5995e97805e68e91e1f191dc5e7910a7f2ba31619eb64aff54877cbd1b3fa08b7a24b411d095edb21877956976777409d3db58d29da32219bf578ce4ef2

                      • C:\Users\Admin\AppData\Local\Temp\onefile_3992_133685059876146390\libssl-3.dll

                        Filesize

                        771KB

                        MD5

                        bfc834bb2310ddf01be9ad9cff7c2a41

                        SHA1

                        fb1d601b4fcb29ff1b13b0d2ed7119bd0472205c

                        SHA256

                        41ad1a04ca27a7959579e87fbbda87c93099616a64a0e66260c983381c5570d1

                        SHA512

                        6af473c7c0997f2847ebe7cee8ef67cd682dee41720d4f268964330b449ba71398fda8954524f9a97cc4cdf9893b8bdc7a1cf40e9e45a73f4f35a37f31c6a9c3

                      • C:\Users\Admin\AppData\Local\Temp\onefile_3992_133685059876146390\python3.dll

                        Filesize

                        65KB

                        MD5

                        ff319d24153238249adea18d8a3e54a7

                        SHA1

                        0474faa64826a48821b7a82ad256525aa9c5315e

                        SHA256

                        a462a21b5f0c05f0f7ec030c4fde032a13b34a8576d661a8e66f9ad23767e991

                        SHA512

                        0e63fe4d5568cd2c54304183a29c7469f769816f517cd2d5b197049aa966c310cc13a7790560ef2edc36b9b6d99ff586698886f906e19645faeb89b0e65adfdd

                      • C:\Users\Admin\AppData\Local\Temp\onefile_3992_133685059876146390\python311.dll

                        Filesize

                        5.5MB

                        MD5

                        86e0ad6ba8a9052d1729db2c015daf1c

                        SHA1

                        48112072903fff2ec5726cca19cc09e42d6384c7

                        SHA256

                        5ecda62f6fd2822355c560412f6d90be46a7f763f0ffeec9854177904632ac2d

                        SHA512

                        5d6e32f9ff90a9a584183dad1583aea2327b4aea32184b0ebbec3df41b0b833e6bb3cd40822dd64d1033125f52255812b17e4fa0add38fcda6bab1724dfaa2eb

                      • C:\Users\Admin\AppData\Local\Temp\onefile_3992_133685059876146390\unicodedata.pyd

                        Filesize

                        1.1MB

                        MD5

                        d4323ac0baab59aed34c761f056d50a9

                        SHA1

                        843687689d21ede9818c6fc5f3772bcf914f8a6e

                        SHA256

                        71d27537eb1e6de76fd145da4fdcbc379dc54de7854c99b2e61aae00109c13d0

                        SHA512

                        e31d071ce920b3e83c89505dfa22b2d0f09d43c408fcadbc910f021481c4a53c47919fce0215ae61f00956dcb7171449eabda8eef63a6fdd47aa13c7158577be

                      • C:\Users\Admin\AppData\Local\Temp\onefile_3992_133685059876146390\vcruntime140.dll

                        Filesize

                        116KB

                        MD5

                        be8dbe2dc77ebe7f88f910c61aec691a

                        SHA1

                        a19f08bb2b1c1de5bb61daf9f2304531321e0e40

                        SHA256

                        4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83

                        SHA512

                        0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655

                      • memory/3864-149-0x00007FF966BA0000-0x00007FF967090000-memory.dmp

                        Filesize

                        4.9MB

                      • memory/3864-150-0x00007FF966080000-0x00007FF9665C1000-memory.dmp

                        Filesize

                        5.3MB

                      • memory/3864-152-0x00007FF7A1950000-0x00007FF7A4DE8000-memory.dmp

                        Filesize

                        52.6MB

                      • memory/3864-172-0x00007FF7A1950000-0x00007FF7A4DE8000-memory.dmp

                        Filesize

                        52.6MB

                      • memory/3864-174-0x00007FF7A1950000-0x00007FF7A4DE8000-memory.dmp

                        Filesize

                        52.6MB

                      • memory/3992-151-0x00007FF77C800000-0x00007FF77E7D1000-memory.dmp

                        Filesize

                        31.8MB