133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53

General

Target

133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe
Size

6.7MB
MD5

91d9d139ce2d791b6686ae07128b51cb
SHA1

46210009701509a198a58bc0a5fa3bcd05c53eb1
SHA256

133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53
SHA512

0488397ba99de52afbb80378589f7a0115006640b02ad7c9c26f73cdc30c72bf6d9f780b03d2a724d38a3a7ecb987d54ca1b4060f135cd61d6d3408d0a7a153f
SSDEEP

196608:fKrCZ3PfOoei6B8v791ZftQzI+HfaQ37WmjUTFJ+:fZpGg791p6U+/aQ377jUTFM

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

BANDIZIP-SETUP-STD-X64.EXE

pid process

1736 BANDIZIP-SETUP-STD-X64.EXE
Loads dropped DLL 1 IoCs

Processes:

133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe

pid process

1216 133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

pid	process
1736	BANDIZIP-SETUP-STD-X64.EXE

pid	process
1216	133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe

Modifies system certificate store 2 TTPs 3 IoCs

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

BANDIZIP-SETUP-STD-X64.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	BANDIZIP-SETUP-STD-X64.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	BANDIZIP-SETUP-STD-X64.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	BANDIZIP-SETUP-STD-X64.EXE

Suspicious use of WriteProcessMemory 60 IoCs

Processes:

133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.execmd.execmd.exe

description	pid	process	target process
PID 1216 wrote to memory of 1648	1216	133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe	cmd.exe
PID 1216 wrote to memory of 1648	1216	133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe	cmd.exe
PID 1216 wrote to memory of 1648	1216	133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe	cmd.exe
PID 1216 wrote to memory of 1648	1216	133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe	cmd.exe
PID 1648 wrote to memory of 756	1648	cmd.exe	attrib.exe
PID 1648 wrote to memory of 756	1648	cmd.exe	attrib.exe
PID 1648 wrote to memory of 756	1648	cmd.exe	attrib.exe
PID 1216 wrote to memory of 464	1216	133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe	cmd.exe
PID 1216 wrote to memory of 464	1216	133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe	cmd.exe
PID 1216 wrote to memory of 464	1216	133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe	cmd.exe
PID 1216 wrote to memory of 464	1216	133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe	cmd.exe
PID 464 wrote to memory of 1496	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1496	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1496	464	cmd.exe	reg.exe
PID 464 wrote to memory of 656	464	cmd.exe	reg.exe
PID 464 wrote to memory of 656	464	cmd.exe	reg.exe
PID 464 wrote to memory of 656	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1924	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1924	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1924	464	cmd.exe	reg.exe
PID 464 wrote to memory of 856	464	cmd.exe	reg.exe
PID 464 wrote to memory of 856	464	cmd.exe	reg.exe
PID 464 wrote to memory of 856	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1820	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1820	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1820	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1744	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1744	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1744	464	cmd.exe	reg.exe
PID 464 wrote to memory of 920	464	cmd.exe	reg.exe
PID 464 wrote to memory of 920	464	cmd.exe	reg.exe
PID 464 wrote to memory of 920	464	cmd.exe	reg.exe
PID 464 wrote to memory of 896	464	cmd.exe	reg.exe
PID 464 wrote to memory of 896	464	cmd.exe	reg.exe
PID 464 wrote to memory of 896	464	cmd.exe	reg.exe
PID 464 wrote to memory of 680	464	cmd.exe	reg.exe
PID 464 wrote to memory of 680	464	cmd.exe	reg.exe
PID 464 wrote to memory of 680	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1392	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1392	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1392	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1552	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1552	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1552	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1704	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1704	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1704	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1096	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1096	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1096	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1656	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1656	464	cmd.exe	reg.exe
PID 464 wrote to memory of 1656	464	cmd.exe	reg.exe
PID 1216 wrote to memory of 1736	1216	133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe	BANDIZIP-SETUP-STD-X64.EXE
PID 1216 wrote to memory of 1736	1216	133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe	BANDIZIP-SETUP-STD-X64.EXE
PID 1216 wrote to memory of 1736	1216	133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe	BANDIZIP-SETUP-STD-X64.EXE
PID 1216 wrote to memory of 1736	1216	133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe	BANDIZIP-SETUP-STD-X64.EXE
PID 1216 wrote to memory of 1736	1216	133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe	BANDIZIP-SETUP-STD-X64.EXE
PID 1216 wrote to memory of 1736	1216	133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe	BANDIZIP-SETUP-STD-X64.EXE
PID 1216 wrote to memory of 1736	1216	133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe	BANDIZIP-SETUP-STD-X64.EXE

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

756 attrib.exe

pid	process
756	attrib.exe

C:\Users\Admin\AppData\Local\Temp\133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe
"C:\Users\Admin\AppData\Local\Temp\133bff26cb2aa0bf4d27369e50b5837caf2f6e1973d98d78530a7500e206bd53.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1216

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c attrib +h "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000"
2⤵
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\system32\attrib.exe
attrib +h "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000"
3⤵
- Views/modifies file attributes
PID:756

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c @pushd "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000" >nul 2>&1 & CALL "C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\First.cmd"
2⤵
- Suspicious use of WriteProcessMemory
PID:464

C:\Windows\system32\reg.exe
Reg.exe add "HKCU\SOFTWARE\Bandizip" /v "doNotCloseExtractDlg" /t REG_DWORD /d "0" /f
3⤵
PID:1496

C:\Windows\system32\reg.exe
Reg.exe add "HKCU\SOFTWARE\Bandizip" /v "assocNotice.disableNoticeZip" /t REG_DWORD /d "1" /f
3⤵
PID:656

C:\Windows\system32\reg.exe
Reg.exe add "HKCU\SOFTWARE\Bandizip" /v "assocNotice.disableNoticeRar" /t REG_DWORD /d "1" /f
3⤵
PID:1924

C:\Windows\system32\reg.exe
Reg.exe add "HKCU\SOFTWARE\Bandizip" /v "assocNotice.disableNotice7z" /t REG_DWORD /d "1" /f
3⤵
PID:856

C:\Windows\system32\reg.exe
Reg.exe add "HKCU\Software\Bandizip" /v "update" /t REG_DWORD /d "2" /f
3⤵
PID:1820

C:\Windows\system32\reg.exe
Reg.exe add "HKCU\Software\Bandizip" /v "shell_ShowSubmenu" /t REG_DWORD /d "1" /f
3⤵
PID:1744

C:\Windows\system32\reg.exe
Reg.exe add "HKCU\SOFTWARE\Bandizip" /v "shell_OpenArchive" /t REG_DWORD /d "1" /f
3⤵
PID:920

C:\Windows\system32\reg.exe
Reg.exe add "HKCU\SOFTWARE\Bandizip" /v "shell_Preview" /t REG_DWORD /d "0" /f
3⤵
PID:896

C:\Windows\system32\reg.exe
Reg.exe add "HKCU\Software\Bandizip" /v "shell_CreateNewFolder" /t REG_DWORD /d "0" /f
3⤵
PID:680

C:\Windows\system32\reg.exe
Reg.exe add "HKCU\Software\Bandizip" /v "bDeleteOutfileWhenUserCancel" /t REG_DWORD /d "1" /f
3⤵
PID:1392

C:\Windows\system32\reg.exe
Reg.exe add "HKCU\Software\Bandizip" /v "openFolderWhenComplete" /t REG_DWORD /d "1" /f
3⤵
PID:1552

C:\Windows\system32\reg.exe
Reg.exe add "HKCU\Software\Bandizip" /v "doNotCloseExtractDlg" /t REG_DWORD /d "0" /f
3⤵
PID:1704

C:\Windows\system32\reg.exe
Reg.exe add "HKCU\Software\Bandizip" /v "bShowStartScreen" /t REG_DWORD /d "0" /f
3⤵
PID:1096

C:\Windows\system32\reg.exe
Reg.exe add "HKCU\Software\Bandizip" /v "bDispFullPathTitlebar" /t REG_DWORD /d "1" /f
3⤵
PID:1656

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\BANDIZIP-SETUP-STD-X64.EXE
"C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\BANDIZIP-SETUP-STD-X64.EXE"
2⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Install Root Certificate

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\BANDIZIP-SETUP-STD-X64.EXE

Filesize
6.8MB

MD5
7793ef9c18f44a5962cc877e7efa110c

SHA1
e3b05cd6c0477fa98e9d14221123c9e09fa5916f

SHA256
58ac6c40593f0e7104ce838ef9163d743a5339166986ee4c3839224b25bddd26

SHA512
b12a34ebda99691add598d0822b9c0ab3bdbad0b6c03d8af14e8799aadc8285a91654e46a087b10289dc86c8eaed86bd4e2d930d86c9aa0ba85010cb852862c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\BANDIZIP-SETUP-STD-X64.EXE

Filesize
6.8MB

MD5
7793ef9c18f44a5962cc877e7efa110c

SHA1
e3b05cd6c0477fa98e9d14221123c9e09fa5916f

SHA256
58ac6c40593f0e7104ce838ef9163d743a5339166986ee4c3839224b25bddd26

SHA512
b12a34ebda99691add598d0822b9c0ab3bdbad0b6c03d8af14e8799aadc8285a91654e46a087b10289dc86c8eaed86bd4e2d930d86c9aa0ba85010cb852862c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\First.cmd

Filesize
1KB

MD5
95caa98042b01e1c4cf47901ca8ac786

SHA1
f041b629b11a65da3c1a3909c88f3e9f1e358f65

SHA256
0476e0d75664e305713767cad87e7b5f2580050c1b4d08799f050f5103728061

SHA512
96cfe1a060ad1d07f2250d6b792c4570a892e9e93a6162e058e22646a99171003eae38ffd2570cbba936b71f8d1953cd1e3eb93137109a805eb5c2126a6663ba

Download Submit
\Users\Admin\AppData\Local\Temp\7ZipSfx.000\BANDIZIP-SETUP-STD-X64.EXE

Filesize
6.8MB

MD5
7793ef9c18f44a5962cc877e7efa110c

SHA1
e3b05cd6c0477fa98e9d14221123c9e09fa5916f

SHA256
58ac6c40593f0e7104ce838ef9163d743a5339166986ee4c3839224b25bddd26

SHA512
b12a34ebda99691add598d0822b9c0ab3bdbad0b6c03d8af14e8799aadc8285a91654e46a087b10289dc86c8eaed86bd4e2d930d86c9aa0ba85010cb852862c2

Download Submit
memory/464-58-0x0000000000000000-mapping.dmp

Download
memory/656-61-0x0000000000000000-mapping.dmp

Download
memory/680-68-0x0000000000000000-mapping.dmp

Download
memory/756-57-0x0000000000000000-mapping.dmp

Download
memory/856-63-0x0000000000000000-mapping.dmp

Download
memory/896-67-0x0000000000000000-mapping.dmp

Download
memory/920-66-0x0000000000000000-mapping.dmp

Download
memory/1096-72-0x0000000000000000-mapping.dmp

Download
memory/1216-54-0x0000000074F01000-0x0000000074F03000-memory.dmp

Filesize
8KB

Download
memory/1216-55-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1216-74-0x0000000000400000-0x000000000043E000-memory.dmp

Filesize
248KB

Download
memory/1392-69-0x0000000000000000-mapping.dmp

Download
memory/1496-60-0x0000000000000000-mapping.dmp

Download
memory/1552-70-0x0000000000000000-mapping.dmp

Download
memory/1648-56-0x0000000000000000-mapping.dmp

Download
memory/1656-73-0x0000000000000000-mapping.dmp

Download
memory/1704-71-0x0000000000000000-mapping.dmp

Download
memory/1736-76-0x0000000000000000-mapping.dmp

Download
memory/1744-65-0x0000000000000000-mapping.dmp

Download
memory/1820-64-0x0000000000000000-mapping.dmp

Download
memory/1924-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing