Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    140s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    01/09/2024, 18:38

General

  • Target

    HDT-Installer (1).exe

  • Size

    99.3MB

  • MD5

    28f5bd4574847e54944f1e2b6e181bbd

  • SHA1

    e04d004bb0d128b35612d85830999231f12828f9

  • SHA256

    f26eeca5c4fb53d26817a14f182be2c3bde5a08ad887a5bf96531b793b5e0eba

  • SHA512

    c4f0fdda9be4fb7f8fea4d567050e4ebff58dec222fb961e032e272514c8e8067ef8c020dce489812293399b13c97390546c1e4e1408a4b00faf644dccb5a5c7

  • SSDEEP

    3145728:IiecVpHnM4Z6JUqN/Kq1hxW/RT98rb777:5VBnPoUGyq1hxUKrb73

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 64 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HDT-Installer (1).exe
    "C:\Users\Admin\AppData\Local\Temp\HDT-Installer (1).exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install .
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2424
      • C:\Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\HearthstoneDeckTracker.exe
        "C:\Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\HearthstoneDeckTracker.exe" --squirrel-install 1.31.5
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:1256
      • C:\Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\HearthstoneDeckTracker.exe
        "C:\Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\HearthstoneDeckTracker.exe" --squirrel-firstrun
        3⤵
        • Executes dropped EXE
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3036

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\HearthstoneDeckTracker.exe

    Filesize

    10.8MB

    MD5

    4ecd6bac2fca7ab49c6c3e06d75d9828

    SHA1

    a0c6917e80815a6c7d9616d477c386d2663c2e69

    SHA256

    60bdfcfd4df10f6eb06521be58afec2c5010e27512a4b95afac264f515e428d3

    SHA512

    ba862d55ecc146294933a63c7694b317ce429afa4a5aa890a1eab41c512c86985a5c1ab5859266b6e3cb99a63928a32499b7e5dbdd26348217701740814d5f22

  • C:\Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\HearthstoneDeckTracker.exe.config

    Filesize

    808B

    MD5

    488c707fd664052c4014f965f277adcd

    SHA1

    9290a6f1c34cde02abb16ac32db005708adc7b70

    SHA256

    703b977a3f38dab4acad4e7d90c90f37e38a3df1d84e2aaaf39580f7fcf67aa2

    SHA512

    b381e439666253521a1f2209dd6e473d98a3a07aa68d21c596a087a6bd6dfd9fffc773d1f6025349298e7c291cea97555959bd4d7a5159fa78173b179271bf45

  • C:\Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\Images\HearthstoneDeckTracker.ico

    Filesize

    278KB

    MD5

    86a70ec53fb53ccc0202c874e17e37b3

    SHA1

    9f98bf62d43f4da885d797cfd4e6e85083087d55

    SHA256

    dba2ec92dab4ebbeb7b9b0560d9fa8e7918768274ca69a978fe0f000c4cb200b

    SHA512

    ab8aa7a5386e6ac8db6e369d807d826a225a1251e5ce20681d75f47be795934ceab45dff4fd826bb1da7f14621b9443dea20646704d7619d736f4cd4d5162219

  • C:\Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\it-IT\HearthstoneDeckTracker.resources.dll

    Filesize

    173KB

    MD5

    610dff3268a0c700d58a3b30c1c49187

    SHA1

    e3f90a5e100350efaa896be089704c8c7e89147e

    SHA256

    61383e0858b8b3a04a5def0612cb52cf307cad5a4ffd8f0bd3e1bc28ba58016a

    SHA512

    df3a4361bb6ad06b070cc7e46f18021263a1664641d5607cd010de392925bcdc0539d0bd7cfb39a9200b293f7645b89ce4933fc0cda8b5cbb9fad611e64c6e4e

  • C:\Users\Admin\AppData\Local\SquirrelTemp\RELEASES

    Filesize

    94B

    MD5

    2cc2c4bd55d1820042406bfa1d1c7105

    SHA1

    5a00372c876c27d4b9a14fc0c903f9d0208734df

    SHA256

    12064235c8d85f468fb3321f6aeef84c843972ac5e85cdb599dd184bde68791a

    SHA512

    5d99400b61555d8994cc8ebf02308643efc78bdb8f884a6c8a22a47c8ea49e563596be006914b4d88040c882f6c656188780665e589ead1f4b081c9187e8ffc0

  • C:\Users\Admin\AppData\Local\Temp\CabDC6C.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\Temp\TarDC8E.tmp

    Filesize

    181KB

    MD5

    4ea6026cf93ec6338144661bf1202cd1

    SHA1

    a1dec9044f750ad887935a01430bf49322fbdcb7

    SHA256

    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

    SHA512

    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

  • C:\Users\Admin\AppData\Roaming\HearthstoneDeckTracker\PlayerDecks.xml.tmp

    Filesize

    264B

    MD5

    9e9b30c803b020d10ba89d87f611ac10

    SHA1

    570473f9d6199dc728263f5f448b34ef9dafe03f

    SHA256

    a610ec69c77df45e9a856facd30e7d9b0af0a02be5f29f134415fff3887e1a0d

    SHA512

    d5ae0c412a9eb42b544d680fa54729a04d40c355aa2de1a7abe97074e79311a8e856a62a5089df0756b37a81ee1785fe2d3f736e2ea59386b90e8f4128ffb0f4

  • C:\Users\Admin\AppData\Roaming\HearthstoneDeckTracker\config.xml.tmp

    Filesize

    20KB

    MD5

    63e6b3269cddd943f9f55cb6115d3908

    SHA1

    b45475b0c2546c314bab513a41be57a061fa3084

    SHA256

    87df09d215c51f7737bff998e3353a829fe2bdc6504378d3e0828ab1f9b773f3

    SHA512

    28bcfe14d3915952aa54e896919f213c66c3fa788c1848b154cb74b1c627002795295112d35c6846b355b33fcfaedc9ae05bb665ab66665a8e352d01796f9f6c

  • \Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\BobsBuddy.dll

    Filesize

    318KB

    MD5

    e1f144b317a8895af833ba0295e421e4

    SHA1

    3cb4f1b0ba6264d5a4c30f550e3c2331fe8225c1

    SHA256

    5b693e27a5d4c77df854cbe7ba9419c286016c772c926a7ee318d7e5c49f6333

    SHA512

    f023435ee287b68d613b45d39d3516e48ad034f353d37e869dd423c578bee8b3238f6f11959b67af018c50fe07a6f33d0c1d3e17020d0a7c5cbc61f4d158f01c

  • \Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\HSReplay.dll

    Filesize

    128KB

    MD5

    8e453b960f6f4642dfd9d59420c56fae

    SHA1

    a8e2a090481dff367df1e79106af45ce40beba8a

    SHA256

    e6525ce11ef6323034f29a07334520d8220ad943bf2313ea64ce3a0c1d19299b

    SHA512

    e30e59d0538b2bbcebff5fb575cd95f4114cfe52a7236e5e3a71d8fe11dbf325113370b6190ced6b197f6bca58312f34f3d2acda2d29b6235743de7ec8e70157

  • \Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\HearthMirror.dll

    Filesize

    251KB

    MD5

    fe66ca1b6bdf3f2e7baa4576e0097bac

    SHA1

    a1f0ed3e1e8ad18ef72a0af66a6f3a2a576466fb

    SHA256

    f85769a1d3481e5b913d48a58ad737fe68d164a86bef956dd567b9f9f2de5526

    SHA512

    ec010fbeaa5cf09b42d5e5e9a602a51e22925fa7f86eabefdd9ecc8d12c357d9ef100ee27f937d9749de1a5df97c321b70d6a96cd2b4db52b034af9f3e62de6a

  • \Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\HearthWatcher.dll

    Filesize

    64KB

    MD5

    51731162ab7d8f7a55e50b3be3b74340

    SHA1

    24a8e3a5caf74edd5ea8a7ad638a3eb06cd24af3

    SHA256

    c91f696d096c06ae72ac429f47a9508fddcc1f4ce84486903b9d7a7f9a58540f

    SHA512

    684122c2b067928f67bcc9433eaa960054766e1886dca3f478a3bed4dc9e3a8ce2931088cb239e26ab40c3e3ba9d10d779198a60e270d684ecd310c062273bea

  • \Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\HtmlAgilityPack.dll

    Filesize

    171KB

    MD5

    7f0f463ce244eaba7eed328cfb00f46d

    SHA1

    24ff2f00747c1465939a0c15cf3ea1e8706049f6

    SHA256

    5d4988faf3c793055c09df30cdac6e495523185e1ff28ad971d0815b49aecf50

    SHA512

    8076f263931e8fce9108d4dd16322670db275e0293f4b584d283adbb1443a881993f95a56d1e9eb7e704b2456866f2e55594e1783bff26ca7176c97dd519f661

  • \Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\LiveCharts.Wpf.dll

    Filesize

    222KB

    MD5

    806549245f29b4c9e17d39f2a3389920

    SHA1

    d5c7c27b94255e782a7d2d79809c59b0da5b5199

    SHA256

    6b070fea30f1643e2198046c78bca934484509c0c613229528bcd6e969d4488d

    SHA512

    750593d0d89ee2c17d726e2403900c5f851cdebc4208fd1ddc7a1931010ab6757ff8c2304c35b8d9d326ad0ae5cdb1b54e28d876abfabfe555bf7206f468d7b7

  • \Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\MahApps.Metro.dll

    Filesize

    1.1MB

    MD5

    b71d79c5cb4b633f69e687c15bda89ad

    SHA1

    bff15df406d84a8172cc8d21f3ecc8a4aff90835

    SHA256

    5d1b9be14ce752624a11bef4f3f0fb4f1535084dd9c026b645fb6bdc1c2f5944

    SHA512

    b0c7db4833239c91be4c9ab2a05a3a0f62633df353c1ac9dbbc4bc92b0a371a4aa2ded8a367429b7e8418d0f27a7d87c3ddc10fb5d126fd831096c5db1095455

  • \Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\Newtonsoft.Json.dll

    Filesize

    683KB

    MD5

    6815034209687816d8cf401877ec8133

    SHA1

    1248142eb45eed3beb0d9a2d3b8bed5fe2569b10

    SHA256

    7f912b28a07c226e0be3acfb2f57f050538aba0100fa1f0bf2c39f1a1f1da814

    SHA512

    3398094ce429ab5dcdecf2ad04803230669bb4accaef7083992e9b87afac55841ba8def2a5168358bd17e60799e55d076b0e5ca44c86b9e6c91150d3dc37c721

  • \Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\Splat.dll

    Filesize

    54KB

    MD5

    c2a954108cf77846c125f7eb5d203d52

    SHA1

    858df5849e30e836472b0fc73f437cbac2fa1163

    SHA256

    d7ac1a5b38d99584412a94f51340d3c19aad8b171468cbc1e149b19937c5a646

    SHA512

    2834c255097d2f5fe71a3e59ef37890392a898515f507d847a7d5912243db1e8918bc5302a504e5a3addf9f5a766eddae2ab5338086be6cdb90c549ea1a937b1

  • \Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\Squirrel.dll

    Filesize

    243KB

    MD5

    4733660a78977fb9816b4cc593f23037

    SHA1

    8448faeae1d2bf66d4a007c0d955595924a758fa

    SHA256

    38f1f4015d92a0d454ccd890ae93e50800e72bc933ea3a874365e1ec19788f00

    SHA512

    5de59d02bb30e886e12628cacacf775f3844fde7f18159542371395340c939c68180fa0bbf7f9d5f76e612d5f17a3f61db4f0b316c0696c4399c520b5c7c57eb

  • \Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\WPFLocalizeExtension.dll

    Filesize

    90KB

    MD5

    e2b4b9d825487d65e6340d1b2cc81e27

    SHA1

    818209e7f021015acdb7fd6b2a07414708abafb4

    SHA256

    dd374aab7a7af65edb0c6dd73976892069259a2d9bd88b78c57d14b9a82af12d

    SHA512

    85becf8f4273da2ddf3ee222449db7d00feffdb353e3e98ace4baa42e087f47a5a2640dd75a2f408bb7fd979b0b5c48f872dd076fdfaef8cf6ef7dd3ad903b68

  • \Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\XAMLMarkupExtensions.dll

    Filesize

    40KB

    MD5

    84178eeebf923d03e3e59013130b9ce8

    SHA1

    e396c655dac7d9b462d80b68caf5c10506343e87

    SHA256

    7b2948f947f601b11387e857a32711c06d880aca4be52938864d558da2082542

    SHA512

    1be10101f76d33b1230b557adb6b81982b69f799be07f45b0a9430dd7310de7ebf69937a6768374047e74f5370687c8d3ee372cd6ff0cacf1f4d5b35c4a599dc

  • \Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\de-DE\HearthstoneDeckTracker.resources.dll

    Filesize

    172KB

    MD5

    dd84bb3e9cc561107be126e72e148a98

    SHA1

    1294049492122a42d4dcb965f8b03980fa1a361a

    SHA256

    da43408e94ba994ef468b8bc116bb0fbbfc53a7deafffe1967728fe516d247a2

    SHA512

    11a1ec3d91234123e5d902340d2ee3097d6bb56cfd191aaf940f3f5002ddbe994e54ab5d17e4ed22e2664d920daeb4dfb2ad40148016af83711dce2f7ba46761

  • \Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\fr-FR\HearthstoneDeckTracker.resources.dll

    Filesize

    177KB

    MD5

    341820839d8a0475e166821048074f8c

    SHA1

    09ce3297090026fccd7a991a9304c59358e39fcd

    SHA256

    d9aa7c62bf226bf6fa48b3cc17f69ccb15b5fd0c2bbb9cccfcecae859d24a484

    SHA512

    ba3fc3481c81f2f2cc57269e62d68103da84d35eadeec9bcaa9ef3fed3105c2afa0a4815140fe4766091ff42b7264b71139dce63a8c379684e306dfb9b892c92

  • \Users\Admin\AppData\Local\HearthstoneDeckTracker\app-1.31.5\zh-TW\HearthstoneDeckTracker.resources.dll

    Filesize

    166KB

    MD5

    0a91d68425febed34085385ce4ba9b94

    SHA1

    11bc5bc6fb2477f5031fed156ad6a1f99050a935

    SHA256

    c9e693c08cec6adcfc44a4b8789d794ba7cf42953381b5f03922a7604b7e8dff

    SHA512

    3af159a6a2dd0068786d0efb1f97613ec8e6ffe9c7bcb528603d1f0199a92cc3203a39096f3a9dda6e32d43feb0c702a32e8ba69854d175c61c471b751f93a77

  • \Users\Admin\AppData\Local\SquirrelTemp\Update.exe

    Filesize

    1.8MB

    MD5

    9e2f80d48052976c0bb8a15e9567bad8

    SHA1

    03cea10cbe15ffe7be9c7111c491b0be7d8e7f0e

    SHA256

    29acc298ffe9cd705f48c187551ee02960bc4a1853b8c07d83ac443b09eb8a8c

    SHA512

    e8ca616528497ff3c8eb8fa4d7a04477b9b5c1c3872574f835fe411dc922bdbbbedfcd9756da2687deb16c7d20e2f790db0e9f3b584d53fd5a66e347cb3d3283

  • memory/1256-344-0x0000000006950000-0x000000000697E000-memory.dmp

    Filesize

    184KB

  • memory/1256-350-0x0000000006A80000-0x0000000006AB0000-memory.dmp

    Filesize

    192KB

  • memory/1256-298-0x00000000058B0000-0x00000000058CA000-memory.dmp

    Filesize

    104KB

  • memory/1256-316-0x0000000004DE0000-0x0000000004DEE000-memory.dmp

    Filesize

    56KB

  • memory/1256-294-0x00000000057F0000-0x0000000005814000-memory.dmp

    Filesize

    144KB

  • memory/1256-326-0x0000000005F90000-0x0000000005FE4000-memory.dmp

    Filesize

    336KB

  • memory/1256-302-0x0000000005980000-0x00000000059C0000-memory.dmp

    Filesize

    256KB

  • memory/1256-306-0x0000000005920000-0x0000000005932000-memory.dmp

    Filesize

    72KB

  • memory/1256-320-0x0000000005D00000-0x0000000005D2E000-memory.dmp

    Filesize

    184KB

  • memory/1256-286-0x0000000004D00000-0x0000000004D1A000-memory.dmp

    Filesize

    104KB

  • memory/1256-290-0x0000000004DF0000-0x0000000004E04000-memory.dmp

    Filesize

    80KB

  • memory/1256-338-0x0000000005FF0000-0x0000000006020000-memory.dmp

    Filesize

    192KB

  • memory/1256-343-0x0000000006920000-0x0000000006942000-memory.dmp

    Filesize

    136KB

  • memory/1256-342-0x00000000068B0000-0x00000000068E0000-memory.dmp

    Filesize

    192KB

  • memory/1256-341-0x00000000066C0000-0x00000000066F0000-memory.dmp

    Filesize

    192KB

  • memory/1256-346-0x00000000069B0000-0x00000000069E4000-memory.dmp

    Filesize

    208KB

  • memory/1256-348-0x0000000006A20000-0x0000000006A46000-memory.dmp

    Filesize

    152KB

  • memory/1256-352-0x00000000072F0000-0x0000000007320000-memory.dmp

    Filesize

    192KB

  • memory/1256-351-0x0000000006AB0000-0x0000000006AD4000-memory.dmp

    Filesize

    144KB

  • memory/1256-310-0x0000000006610000-0x00000000066C0000-memory.dmp

    Filesize

    704KB

  • memory/1256-349-0x0000000006A50000-0x0000000006A7E000-memory.dmp

    Filesize

    184KB

  • memory/1256-400-0x0000000000AC0000-0x0000000000ACA000-memory.dmp

    Filesize

    40KB

  • memory/1256-347-0x00000000069F0000-0x0000000006A1E000-memory.dmp

    Filesize

    184KB

  • memory/1256-345-0x0000000006980000-0x00000000069AE000-memory.dmp

    Filesize

    184KB

  • memory/1256-397-0x000000000DCE0000-0x000000000DD64000-memory.dmp

    Filesize

    528KB

  • memory/1256-340-0x00000000064D0000-0x0000000006500000-memory.dmp

    Filesize

    192KB

  • memory/1256-282-0x0000000007440000-0x000000000C9D6000-memory.dmp

    Filesize

    85.6MB

  • memory/1256-278-0x0000000005760000-0x00000000057A2000-memory.dmp

    Filesize

    264KB

  • memory/1256-334-0x0000000005E60000-0x0000000005E8E000-memory.dmp

    Filesize

    184KB

  • memory/1256-274-0x00000000056E0000-0x000000000571C000-memory.dmp

    Filesize

    240KB

  • memory/1256-330-0x0000000005820000-0x000000000584E000-memory.dmp

    Filesize

    184KB

  • memory/1256-269-0x0000000000AC0000-0x0000000000ACA000-memory.dmp

    Filesize

    40KB

  • memory/1256-270-0x0000000000AC0000-0x0000000000ACA000-memory.dmp

    Filesize

    40KB

  • memory/1256-268-0x0000000006790000-0x00000000068A2000-memory.dmp

    Filesize

    1.1MB

  • memory/1256-263-0x0000000000AD0000-0x000000000159E000-memory.dmp

    Filesize

    10.8MB

  • memory/2424-285-0x0000000000640000-0x000000000064A000-memory.dmp

    Filesize

    40KB

  • memory/2424-284-0x0000000000640000-0x000000000064A000-memory.dmp

    Filesize

    40KB

  • memory/2424-9-0x00000000002B0000-0x0000000000474000-memory.dmp

    Filesize

    1.8MB

  • memory/2424-411-0x0000000000640000-0x000000000064A000-memory.dmp

    Filesize

    40KB

  • memory/3036-405-0x0000000001140000-0x000000000114A000-memory.dmp

    Filesize

    40KB

  • memory/3036-402-0x0000000006690000-0x00000000067A2000-memory.dmp

    Filesize

    1.1MB

  • memory/3036-410-0x00000000055F0000-0x0000000005632000-memory.dmp

    Filesize

    264KB

  • memory/3036-406-0x0000000005130000-0x000000000516C000-memory.dmp

    Filesize

    240KB

  • memory/3036-412-0x00000000075E0000-0x000000000CB76000-memory.dmp

    Filesize

    85.6MB

  • memory/3036-420-0x0000000005170000-0x000000000517E000-memory.dmp

    Filesize

    56KB

  • memory/3036-419-0x00000000064C0000-0x0000000006570000-memory.dmp

    Filesize

    704KB

  • memory/3036-418-0x0000000005BC0000-0x0000000005BD2000-memory.dmp

    Filesize

    72KB

  • memory/3036-421-0x0000000006020000-0x000000000604E000-memory.dmp

    Filesize

    184KB

  • memory/3036-422-0x0000000006410000-0x0000000006464000-memory.dmp

    Filesize

    336KB

  • memory/3036-417-0x0000000005920000-0x0000000005960000-memory.dmp

    Filesize

    256KB

  • memory/3036-437-0x0000000006A80000-0x0000000006AA4000-memory.dmp

    Filesize

    144KB

  • memory/3036-438-0x0000000006AB0000-0x0000000006AE0000-memory.dmp

    Filesize

    192KB

  • memory/3036-436-0x0000000006A50000-0x0000000006A80000-memory.dmp

    Filesize

    192KB

  • memory/3036-435-0x0000000006A20000-0x0000000006A4E000-memory.dmp

    Filesize

    184KB

  • memory/3036-434-0x0000000006990000-0x00000000069B6000-memory.dmp

    Filesize

    152KB

  • memory/3036-433-0x0000000006960000-0x000000000698E000-memory.dmp

    Filesize

    184KB

  • memory/3036-432-0x0000000006920000-0x0000000006954000-memory.dmp

    Filesize

    208KB

  • memory/3036-431-0x00000000068F0000-0x000000000691E000-memory.dmp

    Filesize

    184KB

  • memory/3036-430-0x00000000068C0000-0x00000000068EE000-memory.dmp

    Filesize

    184KB

  • memory/3036-429-0x0000000006890000-0x00000000068B2000-memory.dmp

    Filesize

    136KB

  • memory/3036-428-0x0000000006860000-0x0000000006890000-memory.dmp

    Filesize

    192KB

  • memory/3036-427-0x00000000067E0000-0x0000000006810000-memory.dmp

    Filesize

    192KB

  • memory/3036-426-0x00000000067B0000-0x00000000067E0000-memory.dmp

    Filesize

    192KB

  • memory/3036-425-0x0000000006620000-0x0000000006650000-memory.dmp

    Filesize

    192KB

  • memory/3036-424-0x00000000065F0000-0x000000000661E000-memory.dmp

    Filesize

    184KB

  • memory/3036-423-0x00000000065C0000-0x00000000065EE000-memory.dmp

    Filesize

    184KB

  • memory/3036-416-0x00000000058A0000-0x00000000058BA000-memory.dmp

    Filesize

    104KB

  • memory/3036-415-0x00000000057F0000-0x0000000005814000-memory.dmp

    Filesize

    144KB

  • memory/3036-414-0x00000000057D0000-0x00000000057E4000-memory.dmp

    Filesize

    80KB

  • memory/3036-413-0x00000000050D0000-0x00000000050EA000-memory.dmp

    Filesize

    104KB

  • memory/3036-441-0x000000000DA80000-0x000000000DB04000-memory.dmp

    Filesize

    528KB

  • memory/3036-1270-0x0000000001140000-0x000000000114A000-memory.dmp

    Filesize

    40KB

  • memory/3036-1309-0x000000000D0F0000-0x000000000D0FC000-memory.dmp

    Filesize

    48KB

  • memory/3036-1317-0x000000000D450000-0x000000000D460000-memory.dmp

    Filesize

    64KB

  • memory/3036-1316-0x000000000D4B0000-0x000000000D4E2000-memory.dmp

    Filesize

    200KB

  • memory/3036-1318-0x0000000000FE0000-0x000000000100C000-memory.dmp

    Filesize

    176KB

  • memory/3036-401-0x0000000000360000-0x0000000000E2E000-memory.dmp

    Filesize

    10.8MB