bitrat | b02372e2bef2a657182ad7d232baf35a321d0bc8f707d5f8292ae85f51907702

Analysis

max time kernel
140s
max time network
133s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf9a1a690110be2f207d8015292d14a9.exe
Size

2.3MB
MD5

bf9a1a690110be2f207d8015292d14a9
SHA1

9732b514c34809cc74bd9aae96b2fc0773c6fe7b
SHA256

b02372e2bef2a657182ad7d232baf35a321d0bc8f707d5f8292ae85f51907702
SHA512

d4e02101700bdbed5cbd10be29a787751784052f4c4a6fc7a1ac5ab2f4e160e597b7c32a51c4d647dae0083b04e492ea88b17b18dc524c5544027647cbd8406e
SSDEEP

49152:GLfqBDAfgnwCFIhXeNNmMlXP4RNsMyaxd7Ad/0jdH8a7Lyx:GsFIhu/m04jDTj7G/0jdH

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.38

yosire.duckdns.org:1555

Attributes

communication_password
e10adc3949ba59abbe56e057f20f883e
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

UPX packed file 17 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1560-101-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1560-102-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1560-106-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1560-109-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1560-110-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1560-107-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1560-111-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1560-112-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1560-113-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1560-115-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1560-118-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1560-119-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1560-117-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1560-121-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1560-120-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1560-122-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral1/memory/1560-123-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1560	bf9a1a690110be2f207d8015292d14a9.exe
1560	bf9a1a690110be2f207d8015292d14a9.exe
1560	bf9a1a690110be2f207d8015292d14a9.exe
1560	bf9a1a690110be2f207d8015292d14a9.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2084 set thread context of 1560	2084	bf9a1a690110be2f207d8015292d14a9.exe	43

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1204	powershell.exe
2668	powershell.exe
544	powershell.exe
2960	powershell.exe
320	powershell.exe
852	powershell.exe
2084	bf9a1a690110be2f207d8015292d14a9.exe
2084	bf9a1a690110be2f207d8015292d14a9.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeIncreaseQuotaPrivilege	1204	powershell.exe
Token: SeSecurityPrivilege	1204	powershell.exe
Token: SeTakeOwnershipPrivilege	1204	powershell.exe
Token: SeLoadDriverPrivilege	1204	powershell.exe
Token: SeSystemProfilePrivilege	1204	powershell.exe
Token: SeSystemtimePrivilege	1204	powershell.exe
Token: SeProfSingleProcessPrivilege	1204	powershell.exe
Token: SeIncBasePriorityPrivilege	1204	powershell.exe
Token: SeCreatePagefilePrivilege	1204	powershell.exe
Token: SeBackupPrivilege	1204	powershell.exe
Token: SeRestorePrivilege	1204	powershell.exe
Token: SeShutdownPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeSystemEnvironmentPrivilege	1204	powershell.exe
Token: SeRemoteShutdownPrivilege	1204	powershell.exe
Token: SeUndockPrivilege	1204	powershell.exe
Token: SeManageVolumePrivilege	1204	powershell.exe
Token: 33	1204	powershell.exe
Token: 34	1204	powershell.exe
Token: 35	1204	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeIncreaseQuotaPrivilege	2668	powershell.exe
Token: SeSecurityPrivilege	2668	powershell.exe
Token: SeTakeOwnershipPrivilege	2668	powershell.exe
Token: SeLoadDriverPrivilege	2668	powershell.exe
Token: SeSystemProfilePrivilege	2668	powershell.exe
Token: SeSystemtimePrivilege	2668	powershell.exe
Token: SeProfSingleProcessPrivilege	2668	powershell.exe
Token: SeIncBasePriorityPrivilege	2668	powershell.exe
Token: SeCreatePagefilePrivilege	2668	powershell.exe
Token: SeBackupPrivilege	2668	powershell.exe
Token: SeRestorePrivilege	2668	powershell.exe
Token: SeShutdownPrivilege	2668	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe
Token: SeSystemEnvironmentPrivilege	2668	powershell.exe
Token: SeRemoteShutdownPrivilege	2668	powershell.exe
Token: SeUndockPrivilege	2668	powershell.exe
Token: SeManageVolumePrivilege	2668	powershell.exe
Token: 33	2668	powershell.exe
Token: 34	2668	powershell.exe
Token: 35	2668	powershell.exe
Token: SeDebugPrivilege	544	powershell.exe
Token: SeIncreaseQuotaPrivilege	544	powershell.exe
Token: SeSecurityPrivilege	544	powershell.exe
Token: SeTakeOwnershipPrivilege	544	powershell.exe
Token: SeLoadDriverPrivilege	544	powershell.exe
Token: SeSystemProfilePrivilege	544	powershell.exe
Token: SeSystemtimePrivilege	544	powershell.exe
Token: SeProfSingleProcessPrivilege	544	powershell.exe
Token: SeIncBasePriorityPrivilege	544	powershell.exe
Token: SeCreatePagefilePrivilege	544	powershell.exe
Token: SeBackupPrivilege	544	powershell.exe
Token: SeRestorePrivilege	544	powershell.exe
Token: SeShutdownPrivilege	544	powershell.exe
Token: SeDebugPrivilege	544	powershell.exe
Token: SeSystemEnvironmentPrivilege	544	powershell.exe
Token: SeRemoteShutdownPrivilege	544	powershell.exe
Token: SeUndockPrivilege	544	powershell.exe
Token: SeManageVolumePrivilege	544	powershell.exe
Token: 33	544	powershell.exe
Token: 34	544	powershell.exe
Token: 35	544	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1560	bf9a1a690110be2f207d8015292d14a9.exe
1560	bf9a1a690110be2f207d8015292d14a9.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 1204	2084	bf9a1a690110be2f207d8015292d14a9.exe	28
PID 2084 wrote to memory of 1204	2084	bf9a1a690110be2f207d8015292d14a9.exe	28
PID 2084 wrote to memory of 1204	2084	bf9a1a690110be2f207d8015292d14a9.exe	28
PID 2084 wrote to memory of 1204	2084	bf9a1a690110be2f207d8015292d14a9.exe	28
PID 2084 wrote to memory of 2668	2084	bf9a1a690110be2f207d8015292d14a9.exe	31
PID 2084 wrote to memory of 2668	2084	bf9a1a690110be2f207d8015292d14a9.exe	31
PID 2084 wrote to memory of 2668	2084	bf9a1a690110be2f207d8015292d14a9.exe	31
PID 2084 wrote to memory of 2668	2084	bf9a1a690110be2f207d8015292d14a9.exe	31
PID 2084 wrote to memory of 544	2084	bf9a1a690110be2f207d8015292d14a9.exe	33
PID 2084 wrote to memory of 544	2084	bf9a1a690110be2f207d8015292d14a9.exe	33
PID 2084 wrote to memory of 544	2084	bf9a1a690110be2f207d8015292d14a9.exe	33
PID 2084 wrote to memory of 544	2084	bf9a1a690110be2f207d8015292d14a9.exe	33
PID 2084 wrote to memory of 2960	2084	bf9a1a690110be2f207d8015292d14a9.exe	35
PID 2084 wrote to memory of 2960	2084	bf9a1a690110be2f207d8015292d14a9.exe	35
PID 2084 wrote to memory of 2960	2084	bf9a1a690110be2f207d8015292d14a9.exe	35
PID 2084 wrote to memory of 2960	2084	bf9a1a690110be2f207d8015292d14a9.exe	35
PID 2084 wrote to memory of 320	2084	bf9a1a690110be2f207d8015292d14a9.exe	37
PID 2084 wrote to memory of 320	2084	bf9a1a690110be2f207d8015292d14a9.exe	37
PID 2084 wrote to memory of 320	2084	bf9a1a690110be2f207d8015292d14a9.exe	37
PID 2084 wrote to memory of 320	2084	bf9a1a690110be2f207d8015292d14a9.exe	37
PID 2084 wrote to memory of 852	2084	bf9a1a690110be2f207d8015292d14a9.exe	39
PID 2084 wrote to memory of 852	2084	bf9a1a690110be2f207d8015292d14a9.exe	39
PID 2084 wrote to memory of 852	2084	bf9a1a690110be2f207d8015292d14a9.exe	39
PID 2084 wrote to memory of 852	2084	bf9a1a690110be2f207d8015292d14a9.exe	39
PID 2084 wrote to memory of 1560	2084	bf9a1a690110be2f207d8015292d14a9.exe	43
PID 2084 wrote to memory of 1560	2084	bf9a1a690110be2f207d8015292d14a9.exe	43
PID 2084 wrote to memory of 1560	2084	bf9a1a690110be2f207d8015292d14a9.exe	43
PID 2084 wrote to memory of 1560	2084	bf9a1a690110be2f207d8015292d14a9.exe	43
PID 2084 wrote to memory of 1560	2084	bf9a1a690110be2f207d8015292d14a9.exe	43
PID 2084 wrote to memory of 1560	2084	bf9a1a690110be2f207d8015292d14a9.exe	43
PID 2084 wrote to memory of 1560	2084	bf9a1a690110be2f207d8015292d14a9.exe	43
PID 2084 wrote to memory of 1560	2084	bf9a1a690110be2f207d8015292d14a9.exe	43

C:\Users\Admin\AppData\Local\Temp\bf9a1a690110be2f207d8015292d14a9.exe
"C:\Users\Admin\AppData\Local\Temp\bf9a1a690110be2f207d8015292d14a9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName youtube.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName facebook.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:544
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName outlook.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2960
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName bing.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:320
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection -ComputerName google.com
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:852
- C:\Users\Admin\AppData\Local\Temp\bf9a1a690110be2f207d8015292d14a9.exe
  C:\Users\Admin\AppData\Local\Temp\bf9a1a690110be2f207d8015292d14a9.exe
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetWindowsHookEx
  PID:1560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\2SA5QBFNC1DZVFOL62NB.temp

Filesize
7KB

MD5
f73dd8db13a000ca2bdc4d7190e18128

SHA1
f8ede17b7bfa6a6f273884da0af329eca17a510e

SHA256
ae4c21df5f1df0b06df1e390e2e4825eb8c431044001e0fbbf16e3813d60b08e

SHA512
cc6db5654dca6d691ffac3419c789fe371f6b1d20adbb11b116cbda8d31193acd9407f0522cbf1147a915fb47cc436a80f061c2635194f5b097ff8cabe81587b

Download Submit
memory/320-47-0x000000006F4B0000-0x000000006FA5B000-memory.dmp

Filesize
5.7MB

Download
memory/320-48-0x0000000002F30000-0x0000000002F70000-memory.dmp

Filesize
256KB

Download
memory/320-49-0x000000006F4B0000-0x000000006FA5B000-memory.dmp

Filesize
5.7MB

Download
memory/320-51-0x0000000002F30000-0x0000000002F70000-memory.dmp

Filesize
256KB

Download
memory/320-50-0x0000000002F30000-0x0000000002F70000-memory.dmp

Filesize
256KB

Download
memory/320-55-0x000000006F4B0000-0x000000006FA5B000-memory.dmp

Filesize
5.7MB

Download
memory/544-53-0x000000006F4B0000-0x000000006FA5B000-memory.dmp

Filesize
5.7MB

Download
memory/544-24-0x000000006F4B0000-0x000000006FA5B000-memory.dmp

Filesize
5.7MB

Download
memory/544-25-0x0000000002B80000-0x0000000002BC0000-memory.dmp

Filesize
256KB

Download
memory/544-26-0x000000006F4B0000-0x000000006FA5B000-memory.dmp

Filesize
5.7MB

Download
memory/544-28-0x0000000002B80000-0x0000000002BC0000-memory.dmp

Filesize
256KB

Download
memory/544-27-0x0000000002B80000-0x0000000002BC0000-memory.dmp

Filesize
256KB

Download
memory/852-65-0x0000000002F00000-0x0000000002F40000-memory.dmp

Filesize
256KB

Download
memory/852-98-0x000000006F200000-0x000000006F7AB000-memory.dmp

Filesize
5.7MB

Download
memory/852-63-0x0000000002F00000-0x0000000002F40000-memory.dmp

Filesize
256KB

Download
memory/852-62-0x000000006F200000-0x000000006F7AB000-memory.dmp

Filesize
5.7MB

Download
memory/852-64-0x000000006F200000-0x000000006F7AB000-memory.dmp

Filesize
5.7MB

Download
memory/1204-6-0x000000006F4B0000-0x000000006FA5B000-memory.dmp

Filesize
5.7MB

Download
memory/1204-8-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download
memory/1204-5-0x000000006F4B0000-0x000000006FA5B000-memory.dmp

Filesize
5.7MB

Download
memory/1204-7-0x0000000002800000-0x0000000002840000-memory.dmp

Filesize
256KB

Download
memory/1204-40-0x000000006F4B0000-0x000000006FA5B000-memory.dmp

Filesize
5.7MB

Download
memory/1560-117-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1560-109-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1560-110-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1560-107-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1560-111-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1560-106-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1560-112-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1560-113-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1560-115-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1560-104-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1560-118-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1560-119-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1560-121-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1560-120-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1560-122-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1560-123-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1560-102-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1560-101-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/1560-100-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/2084-96-0x0000000008E90000-0x0000000009028000-memory.dmp

Filesize
1.6MB

Download
memory/2084-67-0x0000000008E90000-0x0000000009028000-memory.dmp

Filesize
1.6MB

Download
memory/2084-74-0x0000000008E90000-0x0000000009028000-memory.dmp

Filesize
1.6MB

Download
memory/2084-76-0x0000000008E90000-0x0000000009028000-memory.dmp

Filesize
1.6MB

Download
memory/2084-78-0x0000000008E90000-0x0000000009028000-memory.dmp

Filesize
1.6MB

Download
memory/2084-80-0x0000000008E90000-0x0000000009028000-memory.dmp

Filesize
1.6MB

Download
memory/2084-82-0x0000000008E90000-0x0000000009028000-memory.dmp

Filesize
1.6MB

Download
memory/2084-84-0x0000000008E90000-0x0000000009028000-memory.dmp

Filesize
1.6MB

Download
memory/2084-86-0x0000000008E90000-0x0000000009028000-memory.dmp

Filesize
1.6MB

Download
memory/2084-88-0x0000000008E90000-0x0000000009028000-memory.dmp

Filesize
1.6MB

Download
memory/2084-90-0x0000000008E90000-0x0000000009028000-memory.dmp

Filesize
1.6MB

Download
memory/2084-92-0x0000000008E90000-0x0000000009028000-memory.dmp

Filesize
1.6MB

Download
memory/2084-94-0x0000000008E90000-0x0000000009028000-memory.dmp

Filesize
1.6MB

Download
memory/2084-1-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2084-97-0x0000000000CC0000-0x0000000000CE6000-memory.dmp

Filesize
152KB

Download
memory/2084-70-0x0000000008E90000-0x0000000009028000-memory.dmp

Filesize
1.6MB

Download
memory/2084-68-0x0000000008E90000-0x0000000009028000-memory.dmp

Filesize
1.6MB

Download
memory/2084-72-0x0000000008E90000-0x0000000009028000-memory.dmp

Filesize
1.6MB

Download
memory/2084-66-0x0000000008E90000-0x000000000902E000-memory.dmp

Filesize
1.6MB

Download
memory/2084-0-0x0000000000F40000-0x0000000001192000-memory.dmp

Filesize
2.3MB

Download
memory/2084-52-0x0000000000E50000-0x0000000000E90000-memory.dmp

Filesize
256KB

Download
memory/2084-108-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2084-41-0x0000000074270000-0x000000007495E000-memory.dmp

Filesize
6.9MB

Download
memory/2084-2-0x0000000000E50000-0x0000000000E90000-memory.dmp

Filesize
256KB

Download
memory/2668-29-0x000000006F4B0000-0x000000006FA5B000-memory.dmp

Filesize
5.7MB

Download
memory/2668-16-0x0000000002AB0000-0x0000000002AF0000-memory.dmp

Filesize
256KB

Download
memory/2668-17-0x0000000002AB0000-0x0000000002AF0000-memory.dmp

Filesize
256KB

Download
memory/2668-18-0x0000000002AB0000-0x0000000002AF0000-memory.dmp

Filesize
256KB

Download
memory/2668-15-0x000000006F4B0000-0x000000006FA5B000-memory.dmp

Filesize
5.7MB

Download
memory/2668-14-0x000000006F4B0000-0x000000006FA5B000-memory.dmp

Filesize
5.7MB

Download
memory/2960-37-0x000000006F4B0000-0x000000006FA5B000-memory.dmp

Filesize
5.7MB

Download
memory/2960-39-0x0000000002510000-0x0000000002550000-memory.dmp

Filesize
256KB

Download
memory/2960-38-0x0000000002510000-0x0000000002550000-memory.dmp

Filesize
256KB

Download
memory/2960-36-0x0000000002510000-0x0000000002550000-memory.dmp

Filesize
256KB

Download
memory/2960-35-0x000000006F4B0000-0x000000006FA5B000-memory.dmp

Filesize
5.7MB

Download
memory/2960-54-0x000000006F4B0000-0x000000006FA5B000-memory.dmp

Filesize
5.7MB

Download