Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

06/04/2024, 03:27

240406-dzvt3ahg7t 8

06/04/2024, 03:23

240406-dxx7eahg4z 6

06/04/2024, 02:55

240406-det22ahe3w 6

06/04/2024, 02:53

240406-dddnnaab24 6

06/04/2024, 02:31

240406-cz4arshh27 6

06/04/2024, 02:28

240406-cyek1shg92 6

Analysis

  • max time kernel
    61s
  • max time network
    65s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06/04/2024, 02:28

General

  • Target

    https://github.com/Netaa33/KRNL-Executor

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Netaa33/KRNL-Executor
    1⤵
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4740
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb56d53cb8,0x7ffb56d53cc8,0x7ffb56d53cd8
      2⤵
        PID:3680
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1932 /prefetch:2
        2⤵
          PID:664
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4880
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
          2⤵
            PID:4588
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
            2⤵
              PID:4952
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
              2⤵
                PID:4912
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3004
              • C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3844 /prefetch:8
                2⤵
                • Suspicious behavior: EnumeratesProcesses
                PID:3224
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
                2⤵
                  PID:1096
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
                  2⤵
                  • NTFS ADS
                  • Suspicious behavior: EnumeratesProcesses
                  PID:3568
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
                  2⤵
                    PID:4176
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4612 /prefetch:1
                    2⤵
                      PID:3728
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
                      2⤵
                        PID:3776
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1888,14887580040890103644,6784883611282689958,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
                        2⤵
                          PID:1432
                      • C:\Windows\System32\CompPkgSrv.exe
                        C:\Windows\System32\CompPkgSrv.exe -Embedding
                        1⤵
                          PID:3644
                        • C:\Windows\System32\CompPkgSrv.exe
                          C:\Windows\System32\CompPkgSrv.exe -Embedding
                          1⤵
                            PID:3028
                          • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
                            "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
                            1⤵
                            • Modifies registry class
                            • Suspicious use of SetWindowsHookEx
                            PID:3104
                          • C:\Windows\System32\rundll32.exe
                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                            1⤵
                              PID:1480
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Installer\Installer.bat" "
                              1⤵
                                PID:3408
                                • C:\Windows\system32\cacls.exe
                                  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
                                  2⤵
                                    PID:4676
                                  • C:\Users\Admin\Downloads\Installer\compiler.exe
                                    compiler.exe config
                                    2⤵
                                      PID:4680
                                  • C:\Users\Admin\Downloads\Installer\compiler.exe
                                    "C:\Users\Admin\Downloads\Installer\compiler.exe"
                                    1⤵
                                      PID:5056
                                    • C:\Users\Admin\Downloads\Installer\compiler.exe
                                      "C:\Users\Admin\Downloads\Installer\compiler.exe" C:\Users\Admin\Downloads\Installer\lua51.dll
                                      1⤵
                                        PID:2492
                                      • C:\Users\Admin\Downloads\Installer\compiler.exe
                                        "C:\Users\Admin\Downloads\Installer\compiler.exe" C:\Users\Admin\Downloads\Installer\config
                                        1⤵
                                          PID:2016

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7499c893-f990-4969-8c89-ae5933f7442e.tmp

                                          Filesize

                                          11KB

                                          MD5

                                          f42737a4e2f40243f65a90baf16d0b1c

                                          SHA1

                                          a5f67611e320ea5b6be57ec7d76b8aabf8691682

                                          SHA256

                                          02df860d555925fe0f96529c6d356690afa64c98c50ee6f18d5e92ebdd2c3634

                                          SHA512

                                          7fcbceb2b5778db35670dca75bfadd246df6bbc165698afaf20af66f955ee6cb6bef728126e666aa6b6aeb3cff928cc0e8ee4d08d058d059e7eccfb0ed5e3bcd

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          96899614360333c9904499393c6e3d75

                                          SHA1

                                          bbfa17cf8df01c266323965735f00f0e9e04cd34

                                          SHA256

                                          486e4b4bb11f664c91c675e73cfeabe53b5009ae719459813be17814cd97e43c

                                          SHA512

                                          974735b40a9f92b40a37a698f7f333590f32ff45633c6e619500e74ec274bc20bf7dbc830b1685777b714d37a3ca103d741ee056f4ff45ef08c07b38a7895df7

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                          Filesize

                                          152B

                                          MD5

                                          19a8bcb40a17253313345edd2a0da1e7

                                          SHA1

                                          86fac74b5bbc59e910248caebd1176a48a46d72e

                                          SHA256

                                          b8024fbed11683ef4b53f5afac0ff691025b7eecca0f6a95737da1585558227e

                                          SHA512

                                          9f8780f49d30aad01b28189804329aeca6ad2b7ffb6be505d40bb1af7802bb62622f518cb1c43a5815bbbb46638f6c52aead3d68f14fa957d18157edb42e95c0

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          1KB

                                          MD5

                                          4de1f797c984af1b280b577ecb4a7494

                                          SHA1

                                          d79c01e1236ba81eabfef2ff993244a89b831183

                                          SHA256

                                          1842c766983131f724db7a2e97ae72fe1b927fa1d49cf05d317b80946a2d448a

                                          SHA512

                                          ed8eb645cea40a2299ee86ac1f7e02f5788893634e0e0fec818b46b602084ba01f6829c91fb6e35c3215475143efe25ee26e166ee9a7e958e3a8a378b8506fd2

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          5KB

                                          MD5

                                          d25a5a6f01580ac256eb8c34b6a0ab0b

                                          SHA1

                                          a9a421fe20fb8e9a17520ef8aee32316356d5185

                                          SHA256

                                          a1f15a991a52edfbd40e9f6611aa656b36d96fe4826ce9344b299eed82fafb2d

                                          SHA512

                                          035a60f28f0680de1b9e43f7b0628a54186d89a434e52e490f3925e35656a90c78f9e5a9e756830f7f713765ccc0e5bf2ce1d2f610dd2dee79711898561ec3e3

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          006d71481354cc6098fe76bdccf99d33

                                          SHA1

                                          51df0c747e0eb9d2b4fc33d886029ed4d6a7e533

                                          SHA256

                                          7316633ec356c53eac0c7411a0270542c1a5572950a083339963203b44b9aaee

                                          SHA512

                                          c9c5e4d030b55fcff030281c0272293be4ed45392f88d669cd19b81db9b7087f0ee2d313af36d37f708c8d89cdddfd8ff72b232052c182c8170bb3a14fca0bb5

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                          Filesize

                                          1KB

                                          MD5

                                          40bdda4158307f323408d5bc47952dfe

                                          SHA1

                                          6d5973f8ca5c9d37d869b7390100eff9657c2851

                                          SHA256

                                          bb866dd3fa2eeb4d425931095420197b5b1d0ee656c035de476ad5d3d97d3095

                                          SHA512

                                          65405ee1455287097ae91d402543b0b97088de028043ff1114b7937c7ed0c94963b62c15cc31da8f257bd98ebb5a9772fe4c36ce200d4ff8315ea10677ceb120

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c256.TMP

                                          Filesize

                                          874B

                                          MD5

                                          56fa881319678f17b51221b50eda332e

                                          SHA1

                                          60690f62eec6474cf98360f471190be09f5e8da0

                                          SHA256

                                          4f2b11b47ada30ac70335999b879a2a56069504a9b241437cc3bc05dd4871ec7

                                          SHA512

                                          5f7edc2f33267ff35a39e82029c9bffeb1769646597814f4607ba91d979382a4635c222a4a3eeb4efc2903da78236c9da13008c8cd0894076bf4627d5dfd80cf

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                          Filesize

                                          16B

                                          MD5

                                          6752a1d65b201c13b62ea44016eb221f

                                          SHA1

                                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                          SHA256

                                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                          SHA512

                                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                          Filesize

                                          11KB

                                          MD5

                                          1db2bdc3f0fc09b5e2d4e04c108200c0

                                          SHA1

                                          00f911685acf55d9f70185836155a711302f9e0a

                                          SHA256

                                          2ac6f914902059210449a8d77e11e2e8480f09c85a8155d525475cc3061e01bb

                                          SHA512

                                          4f0751becd398f698fc8298e167d8d7490f485e8ce614efa420bb71a74f5578e7d86bc32a6cd8b54266eaf61d3bb4fce2ab050538072be913a9d20205bb061b6

                                        • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

                                          Filesize

                                          10KB

                                          MD5

                                          eebfb84605e05222e3ad98f4b9f62db2

                                          SHA1

                                          36ddd440df5b2776281ad245a6a57e7a183c09a0

                                          SHA256

                                          4a9b70f7113d5c252937ad9bbfa110031124ffe3643648db3f944111b61bd559

                                          SHA512

                                          90e6f46d36c30783af4032f72beb58eb157849a8197e39945542da8a0c1313cb87e91f18a732f5718ec6a676fcd790458419bcc22c608824416fa6df14bf5ba6

                                        • C:\Users\Admin\Downloads\Installer.zip

                                          Filesize

                                          476KB

                                          MD5

                                          9bda27c2159a36fadbbb4b073eb58363

                                          SHA1

                                          e1c38a62e2f7efc3ce4e0a3c81375f8fbfe36826

                                          SHA256

                                          2eb959e06c121bd6ea9e5cc6edb280aca21344837f653660f5c97b46efb97793

                                          SHA512

                                          195ea7bcbc412a2ca57c5bfb1090f7c378deb77625efd7ac590cd0150ee39fa1a85dde264f270e1d9621562ab16db0366a019d5ecc6340b447baafa2844fbfbd

                                        • C:\Users\Admin\Downloads\Installer.zip:Zone.Identifier

                                          Filesize

                                          624B

                                          MD5

                                          1afebadc346c78290cda580f675ece45

                                          SHA1

                                          5539564649a0da40b3615fa36a2658b5ea9c2e27

                                          SHA256

                                          51e0d629f05ff274bf0d31c5284630d9c9020f3015cae114d36efa39db1eef0d

                                          SHA512

                                          59ed5b84b51c1b7a36063c85fcbe45f4148798eede696129a95fb4517ed8b73ff3dd29ae5fc5531fbe312a99c685f95112d0add80b414eef2c9825cee4a6ea84

                                        • memory/2016-631-0x0000000002CE0000-0x0000000002CE1000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4680-238-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-247-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-213-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-222-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-221-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-223-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-220-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-218-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-219-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-224-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-217-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-216-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-215-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-214-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-225-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-226-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-227-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-228-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-229-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-230-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-231-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-232-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-233-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-234-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-235-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-236-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-237-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-211-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-239-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-240-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-241-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-242-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-243-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-244-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-246-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-212-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-245-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-249-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-248-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-250-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-251-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-252-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-253-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-254-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-255-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-256-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-257-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-262-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-263-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-261-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-264-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-260-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-259-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-258-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-265-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-266-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-267-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-268-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-269-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-270-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-271-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-272-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-273-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB

                                        • memory/4680-384-0x0000000002C40000-0x0000000002C41000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4680-388-0x0000000002C40000-0x0000000002C41000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4680-389-0x0000000002C40000-0x0000000002C41000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4680-399-0x0000000002C40000-0x0000000002C41000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4680-455-0x0000000002C40000-0x0000000002C41000-memory.dmp

                                          Filesize

                                          4KB

                                        • memory/4680-210-0x000000007F0F0000-0x000000007F100000-memory.dmp

                                          Filesize

                                          64KB