bitrat | b16a424da66859604542b125c1db27fedd52eb23db2d7459299849408c739d71

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
21-03-2024 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

da9812a342b10c1429a60af815cc85f5.exe
Size

2.7MB
MD5

da9812a342b10c1429a60af815cc85f5
SHA1

3a81dace6a19ccd2564564c90e92099addcf539a
SHA256

b16a424da66859604542b125c1db27fedd52eb23db2d7459299849408c739d71
SHA512

e7c6736493603dc10f0d7675d8d667fb8418449c4e2f8e555a7a47e7e8254964d72a86a576f810a1084e53959934ff64323a659b690d40021796111606e3803a
SSDEEP

49152:UTCl/+XjmjnJ1vN0kGOWmSPrH+HVGvzzRUc6lwuZ1cT2/LRS:2O/jrykGOWmSK1AajZ1c6T0

Score

10^/10

bitrat trojan upx

Malware Config

Extracted

Family

bitrat

Version

1.35

storage.nsupdate.info:8973

Attributes

communication_password
bf771c9d082071fe80b18bb678220682
tor_process
tor

Signatures

BitRAT
BitRAT is a remote access tool written in C++ and uses leaked source code from other families.
trojan bitrat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

da9812a342b10c1429a60af815cc85f5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000\Control Panel\International\Geo\Nation	da9812a342b10c1429a60af815cc85f5.exe

UPX packed file 25 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3760-48-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-49-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-50-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-52-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-54-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-100-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-120-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-123-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-122-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-124-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-125-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-127-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-118-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-144-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-145-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-148-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-149-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-151-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-152-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-154-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-155-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-157-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-158-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-160-0x0000000000400000-0x00000000007E4000-memory.dmp	upx
behavioral2/memory/3760-161-0x0000000000400000-0x00000000007E4000-memory.dmp	upx

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

Processes:

MSBuild.exe

pid process

3760 MSBuild.exe
3760 MSBuild.exe
3760 MSBuild.exe
3760 MSBuild.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

da9812a342b10c1429a60af815cc85f5.exe

description pid process target process

PID 4868 set thread context of 3760 4868 da9812a342b10c1429a60af815cc85f5.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

4404 schtasks.exe

pid	process
3760	MSBuild.exe
3760	MSBuild.exe
3760	MSBuild.exe
3760	MSBuild.exe

description	pid	process	target process
PID 4868 set thread context of 3760	4868	da9812a342b10c1429a60af815cc85f5.exe	MSBuild.exe

pid	process
4404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

powershell.exepowershell.exeda9812a342b10c1429a60af815cc85f5.exepowershell.exe

pid	process
868	powershell.exe
868	powershell.exe
3836	powershell.exe
3836	powershell.exe
3836	powershell.exe
4868	da9812a342b10c1429a60af815cc85f5.exe
4868	da9812a342b10c1429a60af815cc85f5.exe
4892	powershell.exe
4892	powershell.exe
868	powershell.exe
4892	powershell.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

Processes:

powershell.exepowershell.exeda9812a342b10c1429a60af815cc85f5.exepowershell.exeMSBuild.exe

description	pid	process
Token: SeDebugPrivilege	868	powershell.exe
Token: SeDebugPrivilege	3836	powershell.exe
Token: SeDebugPrivilege	4868	da9812a342b10c1429a60af815cc85f5.exe
Token: SeDebugPrivilege	4892	powershell.exe
Token: SeShutdownPrivilege	3760	MSBuild.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

MSBuild.exe

pid process

3760 MSBuild.exe
3760 MSBuild.exe

pid	process
3760	MSBuild.exe
3760	MSBuild.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

da9812a342b10c1429a60af815cc85f5.exe

description	pid	process	target process
PID 4868 wrote to memory of 868	4868	da9812a342b10c1429a60af815cc85f5.exe	powershell.exe
PID 4868 wrote to memory of 868	4868	da9812a342b10c1429a60af815cc85f5.exe	powershell.exe
PID 4868 wrote to memory of 868	4868	da9812a342b10c1429a60af815cc85f5.exe	powershell.exe
PID 4868 wrote to memory of 3836	4868	da9812a342b10c1429a60af815cc85f5.exe	powershell.exe
PID 4868 wrote to memory of 3836	4868	da9812a342b10c1429a60af815cc85f5.exe	powershell.exe
PID 4868 wrote to memory of 3836	4868	da9812a342b10c1429a60af815cc85f5.exe	powershell.exe
PID 4868 wrote to memory of 4404	4868	da9812a342b10c1429a60af815cc85f5.exe	schtasks.exe
PID 4868 wrote to memory of 4404	4868	da9812a342b10c1429a60af815cc85f5.exe	schtasks.exe
PID 4868 wrote to memory of 4404	4868	da9812a342b10c1429a60af815cc85f5.exe	schtasks.exe
PID 4868 wrote to memory of 4892	4868	da9812a342b10c1429a60af815cc85f5.exe	powershell.exe
PID 4868 wrote to memory of 4892	4868	da9812a342b10c1429a60af815cc85f5.exe	powershell.exe
PID 4868 wrote to memory of 4892	4868	da9812a342b10c1429a60af815cc85f5.exe	powershell.exe
PID 4868 wrote to memory of 3760	4868	da9812a342b10c1429a60af815cc85f5.exe	MSBuild.exe
PID 4868 wrote to memory of 3760	4868	da9812a342b10c1429a60af815cc85f5.exe	MSBuild.exe
PID 4868 wrote to memory of 3760	4868	da9812a342b10c1429a60af815cc85f5.exe	MSBuild.exe
PID 4868 wrote to memory of 3760	4868	da9812a342b10c1429a60af815cc85f5.exe	MSBuild.exe
PID 4868 wrote to memory of 3760	4868	da9812a342b10c1429a60af815cc85f5.exe	MSBuild.exe
PID 4868 wrote to memory of 3760	4868	da9812a342b10c1429a60af815cc85f5.exe	MSBuild.exe
PID 4868 wrote to memory of 3760	4868	da9812a342b10c1429a60af815cc85f5.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\da9812a342b10c1429a60af815cc85f5.exe
"C:\Users\Admin\AppData\Local\Temp\da9812a342b10c1429a60af815cc85f5.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\da9812a342b10c1429a60af815cc85f5.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:868

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QIkZZSzTmzZHAr.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3836

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QIkZZSzTmzZHAr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp142F.tmp"
2⤵
- Creates scheduled task(s)
PID:4404

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\QIkZZSzTmzZHAr.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4892

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3760

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
968cb9309758126772781b83adb8a28f

SHA1
8da30e71accf186b2ba11da1797cf67f8f78b47c

SHA256
92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

SHA512
4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
27a3ab7ce4b1d0da576707d1b2263ab7

SHA1
443993456d0fa68d4dcf2c5bd0c4a1a8efdc1582

SHA256
63b3280018728c48578ebb5ac27f750c0bb0c5fc4370b2164724f6d5b9bc00b8

SHA512
24df0adf3ef89ff049c5af1a5bc5235def61d94fe0537992eb17ab51be869c6c8a40f16b7e963a0062814b2f1861427c7e82b99d9dc20eea982659d6d5e11d2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sw2mhc5z.kuv.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp142F.tmp
Filesize
1KB

MD5
23053e8de4ffbb9dd52cd00d8f2fa143

SHA1
ae434e3bf275e59c45677478274843e5345752a7

SHA256
b4b089c4a8ad266e9808737c9541c2f8099861e6f39b4dd9610572b13f9e3de5

SHA512
d01d564eeacdebafcbf398525156474d7abe17f9d4adc0bdd657d80a79a625ff49e22eb27b3583197b0c043404be56ede95cf8b5d912ca6a5ef4b3557707c56e

Download Submit
memory/868-141-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/868-17-0x0000000004DE0000-0x0000000004E16000-memory.dmp

Filesize
216KB

Download
memory/868-112-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/868-121-0x0000000007960000-0x00000000079F6000-memory.dmp

Filesize
600KB

Download
memory/868-47-0x0000000006000000-0x0000000006354000-memory.dmp

Filesize
3.3MB

Download
memory/868-133-0x0000000007A00000-0x0000000007A08000-memory.dmp

Filesize
32KB

Download
memory/868-86-0x0000000075470000-0x00000000754BC000-memory.dmp

Filesize
304KB

Download
memory/868-84-0x000000007FDE0000-0x000000007FDF0000-memory.dmp

Filesize
64KB

Download
memory/868-99-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/868-111-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/868-19-0x00000000054A0000-0x0000000005AC8000-memory.dmp

Filesize
6.2MB

Download
memory/868-20-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/868-18-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/868-21-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/868-22-0x00000000053D0000-0x00000000053F2000-memory.dmp

Filesize
136KB

Download
memory/868-97-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/868-98-0x0000000004E60000-0x0000000004E70000-memory.dmp

Filesize
64KB

Download
memory/3760-144-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-125-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-148-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-149-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-151-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-129-0x00000000705A0000-0x00000000705D9000-memory.dmp

Filesize
228KB

Download
memory/3760-48-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-49-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-50-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-52-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-54-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-118-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-127-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-145-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-124-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-122-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-123-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-152-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-120-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-119-0x0000000071390000-0x00000000713C9000-memory.dmp

Filesize
228KB

Download
memory/3760-154-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-155-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-100-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-157-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-158-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-160-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3760-161-0x0000000000400000-0x00000000007E4000-memory.dmp

Filesize
3.9MB

Download
memory/3836-25-0x0000000004E00000-0x0000000004E66000-memory.dmp

Filesize
408KB

Download
memory/3836-24-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/3836-85-0x0000000007590000-0x0000000007C0A000-memory.dmp

Filesize
6.5MB

Download
memory/3836-83-0x0000000006BF0000-0x0000000006C93000-memory.dmp

Filesize
652KB

Download
memory/3836-87-0x0000000006F40000-0x0000000006F5A000-memory.dmp

Filesize
104KB

Download
memory/3836-82-0x0000000002310000-0x0000000002320000-memory.dmp

Filesize
64KB

Download
memory/3836-113-0x0000000006FC0000-0x0000000006FCA000-memory.dmp

Filesize
40KB

Download
memory/3836-81-0x00000000061D0000-0x00000000061EE000-memory.dmp

Filesize
120KB

Download
memory/3836-31-0x0000000002310000-0x0000000002320000-memory.dmp

Filesize
64KB

Download
memory/3836-142-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/3836-117-0x0000000002310000-0x0000000002320000-memory.dmp

Filesize
64KB

Download
memory/3836-116-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/3836-71-0x0000000075470000-0x00000000754BC000-memory.dmp

Filesize
304KB

Download
memory/3836-70-0x0000000006BA0000-0x0000000006BD2000-memory.dmp

Filesize
200KB

Download
memory/3836-69-0x000000007F800000-0x000000007F810000-memory.dmp

Filesize
64KB

Download
memory/3836-59-0x0000000005CC0000-0x0000000005D0C000-memory.dmp

Filesize
304KB

Download
memory/3836-56-0x0000000005C20000-0x0000000005C3E000-memory.dmp

Filesize
120KB

Download
memory/3836-38-0x0000000005600000-0x0000000005666000-memory.dmp

Filesize
408KB

Download
memory/3836-132-0x0000000007280000-0x000000000729A000-memory.dmp

Filesize
104KB

Download
memory/3836-131-0x0000000007180000-0x0000000007194000-memory.dmp

Filesize
80KB

Download
memory/3836-126-0x0000000007140000-0x0000000007151000-memory.dmp

Filesize
68KB

Download
memory/3836-130-0x0000000007170000-0x000000000717E000-memory.dmp

Filesize
56KB

Download
memory/3836-128-0x0000000002310000-0x0000000002320000-memory.dmp

Filesize
64KB

Download
memory/3836-37-0x0000000002310000-0x0000000002320000-memory.dmp

Filesize
64KB

Download
memory/4868-10-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/4868-3-0x0000000005300000-0x00000000058A4000-memory.dmp

Filesize
5.6MB

Download
memory/4868-12-0x00000000098B0000-0x0000000009A28000-memory.dmp

Filesize
1.5MB

Download
memory/4868-2-0x0000000004CA0000-0x0000000004D3C000-memory.dmp

Filesize
624KB

Download
memory/4868-11-0x00000000062A0000-0x000000000648E000-memory.dmp

Filesize
1.9MB

Download
memory/4868-1-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/4868-4-0x0000000004DF0000-0x0000000004E82000-memory.dmp

Filesize
584KB

Download
memory/4868-53-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/4868-0-0x0000000000080000-0x0000000000330000-memory.dmp

Filesize
2.7MB

Download
memory/4868-5-0x0000000004FE0000-0x0000000004FF0000-memory.dmp

Filesize
64KB

Download
memory/4868-6-0x0000000004DB0000-0x0000000004DBA000-memory.dmp

Filesize
40KB

Download
memory/4868-9-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/4868-8-0x0000000004E90000-0x0000000004EAE000-memory.dmp

Filesize
120KB

Download
memory/4868-7-0x0000000004EF0000-0x0000000004F46000-memory.dmp

Filesize
344KB

Download
memory/4892-101-0x0000000075470000-0x00000000754BC000-memory.dmp

Filesize
304KB

Download
memory/4892-55-0x0000000074BC0000-0x0000000075370000-memory.dmp

Filesize
7.7MB

Download
memory/4892-114-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/4892-115-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/4892-58-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download
memory/4892-57-0x0000000005370000-0x0000000005380000-memory.dmp

Filesize
64KB

Download