blackmoon | a2e8843e56a343eb851c92463c123b06c2edc8a7c4704ec51e4ba42405cdb9b4

Analysis

max time kernel
146s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 10:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SALIKHACK/SALIKHACK.exe
Size

3.1MB
MD5

3be8fa0b38501cdb368c5cf5a0615880
SHA1

52083abf2794b5f6f8a429ef5bf5fa552896832f
SHA256

1d0c2228e4f710999bd97385b1595cd48bc9b79a837a01eff63efb470a1f92ba
SHA512

4d60b1c7d41f9a03147cf1d81640d9b6cd09078c9a8e1634006f505c95cf81a3f0a2f3f31b6c925fd9c90be6c733cac7a54cadf19b0dd0b63ea2b2d8a78ea5bd
SSDEEP

49152:eFnAp4kyST0QX9i41ZmCq6M+s8KuqGaX0ToIBAUZLYRXcYz7NWu22wS3BNM8:eFw7ySwQX9iC4n0JBAUZLuMYz1BN

Score

10^/10

blackmoon poullight banker spyware stealer trojan

Malware Config

Signatures

Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
trojan banker blackmoon

Detect Blackmoon payload 2 IoCs

resource	yara_rule
behavioral4/files/0x000900000002341a-17.dat	family_blackmoon
behavioral4/memory/2712-23-0x0000000000400000-0x000000000072B000-memory.dmp	family_blackmoon

Poullight
Poullight is an information stealer first seen in March 2020.
trojan stealer poullight

Poullight Stealer payload 3 IoCs

resource	yara_rule
behavioral4/files/0x000a0000000233c2-4.dat	family_poullight
behavioral4/memory/4584-12-0x000002D3FCF30000-0x000002D3FCF50000-memory.dmp	family_poullight
behavioral4/memory/2712-23-0x0000000000400000-0x000000000072B000-memory.dmp	family_poullight

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	SALIKHACK.exe

Executes dropped EXE 2 IoCs

pid	Process
4584	build.exe
980	SALIK.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
4940	msedge.exe
4940	msedge.exe
4584	build.exe
4584	build.exe
4584	build.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe
1408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	build.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
980	SALIK.exe
980	SALIK.exe
980	SALIK.exe
980	SALIK.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 4584	2712	SALIKHACK.exe	84
PID 2712 wrote to memory of 4584	2712	SALIKHACK.exe	84
PID 2712 wrote to memory of 980	2712	SALIKHACK.exe	85
PID 2712 wrote to memory of 980	2712	SALIKHACK.exe	85
PID 2712 wrote to memory of 980	2712	SALIKHACK.exe	85
PID 980 wrote to memory of 4940	980	SALIK.exe	89
PID 980 wrote to memory of 4940	980	SALIK.exe	89
PID 4940 wrote to memory of 3516	4940	msedge.exe	90
PID 4940 wrote to memory of 3516	4940	msedge.exe	90
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 1128	4940	msedge.exe	91
PID 4940 wrote to memory of 2956	4940	msedge.exe	92
PID 4940 wrote to memory of 2956	4940	msedge.exe	92
PID 4940 wrote to memory of 4340	4940	msedge.exe	93
PID 4940 wrote to memory of 4340	4940	msedge.exe	93
PID 4940 wrote to memory of 4340	4940	msedge.exe	93
PID 4940 wrote to memory of 4340	4940	msedge.exe	93
PID 4940 wrote to memory of 4340	4940	msedge.exe	93
PID 4940 wrote to memory of 4340	4940	msedge.exe	93
PID 4940 wrote to memory of 4340	4940	msedge.exe	93
PID 4940 wrote to memory of 4340	4940	msedge.exe	93
PID 4940 wrote to memory of 4340	4940	msedge.exe	93
PID 4940 wrote to memory of 4340	4940	msedge.exe	93
PID 4940 wrote to memory of 4340	4940	msedge.exe	93
PID 4940 wrote to memory of 4340	4940	msedge.exe	93
PID 4940 wrote to memory of 4340	4940	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\SALIKHACK\SALIKHACK.exe
"C:\Users\Admin\AppData\Local\Temp\SALIKHACK\SALIKHACK.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Users\Admin\AppData\Local\Temp\build.exe
  "C:\Users\Admin\AppData\Local\Temp\build.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4584
- C:\Users\Admin\AppData\Local\Temp\SALIK.exe
  "C:\Users\Admin\AppData\Local\Temp\SALIK.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://jq.qq.com/?_wv=1027&k=57Cts1S
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4940
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b47646f8,0x7ff8b4764708,0x7ff8b4764718
      4⤵
      PID:3516
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8192875232186047305,14447963352156071253,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
      4⤵
      PID:1128
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,8192875232186047305,14447963352156071253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,8192875232186047305,14447963352156071253,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
      4⤵
      PID:4340
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8192875232186047305,14447963352156071253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
      4⤵
      PID:4000
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8192875232186047305,14447963352156071253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,8192875232186047305,14447963352156071253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
      4⤵
      PID:3108
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,8192875232186047305,14447963352156071253,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0fad3e3c967ab50c762196ca2c64f87f

SHA1
e38d2ce7dbf9ea52fa3bb0fb9712cb7d4ba0b2ea

SHA256
5f83a27fb4024ad0a2e58720eb7b439403293e6e99d1f23757a25dd444caeaa5

SHA512
b16d4b5ed2355234798ea35a492e2f52af5751e4c86ae88d5ed32fd1cccade466e68628c68d9b0571ac870b4a414480f4b129bbcad551dee1a898b5043c8d5b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
66546d535322f871d54b8cdd64e1d756

SHA1
65277624199dee1af5d10de1ef700447a2292c07

SHA256
7d52651150d918ae0607098ba6edc60cfa2b5d4168aaba1d113fb706415eecb0

SHA512
0380968594c7bbb2474dfef13557d6610707896d59cfd82d5358483c1eb6bfc49b8c7e54ab0858b04abcaad1a2ef5acf9754b834699cdcd31100ba06085126cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
78579988d10e9ff86fc25cdcfb939582

SHA1
d004b1d6d22190b1cbcd5bb221a42ccb177534a9

SHA256
725d8d38376116277bf8cefd42314abfa662b1211ae3adc8231cfbc325b3bcba

SHA512
55bfe77e694ec76e2ec2eccccbb24280e3b0ceb4a59bff7271fe0a369de9f450882714e335f2f25d2ad2ca9ec0a5c1a5dcfd52d43bfe69ba9de6a0e09294ac29

Download Submit
C:\Users\Admin\AppData\Local\Temp\SALIK.exe

Filesize
3.0MB

MD5
d0bb5ffd1587460bdc47b813edde4c45

SHA1
f81429c4f3b3711be166a13c3736bd13a77e200a

SHA256
297aafb2fee9ca3a270f8b6189699c71f60281c5ad3d4a217139d9b97aca22f4

SHA512
e8c135e7cfec7d8eed4a10315edb65839914dbbdda660257565002fdf3bba39685a27418e11c3f77781e76b730ac60435b8381dd85d92de529305ac5a6053327

Download Submit
C:\Users\Admin\AppData\Local\Temp\build.exe

Filesize
100KB

MD5
7151a5a9e84c669ffcee99029e679cd3

SHA1
8d596f5f14dabb069242f04797f70f288657017e

SHA256
d8712c18fd5c3d02d1f799c5b829050dbe8932187d0ce2ce7d1cfe9741fa8b60

SHA512
83ca6940e55c2a84ab2597e9a8102b9ff5d6da3b4b07c164b3ae57780a85e2358dbb93f1abe02ef68defcd53eee637ed2e11168977d4d326f6535a33edc9a2a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\ot0qvq0mgex4sz9jek

Filesize
100KB

MD5
9ac3596c1d5e25667ddeb1d999880ddf

SHA1
d838f60a5360744e8b27d3a848d454b2593e55fe

SHA256
6fa7d6a6c10ee18e1e2f97de06156bd18d909948a9598999f79751493e1bf5bc

SHA512
9335f0b67674b794272ad1b83a75c05bb7a263cd678c050ed25fc23ea417a95eee629325028e1bfe1e6350a0d97dac19431c89ea3abe0927aa53a91671e98b47

Download Submit
memory/980-26-0x0000000002400000-0x000000000250D000-memory.dmp

Filesize
1.1MB

Download
memory/980-147-0x0000000002400000-0x000000000250D000-memory.dmp

Filesize
1.1MB

Download
memory/2712-23-0x0000000000400000-0x000000000072B000-memory.dmp

Filesize
3.2MB

Download
memory/4584-101-0x000002D3FF530000-0x000002D3FF542000-memory.dmp

Filesize
72KB

Download
memory/4584-81-0x000002D398E90000-0x000002D3993B8000-memory.dmp

Filesize
5.2MB

Download
memory/4584-25-0x00007FF8B91A0000-0x00007FF8B9C61000-memory.dmp

Filesize
10.8MB

Download
memory/4584-78-0x000002D400000000-0x000002D4001C2000-memory.dmp

Filesize
1.8MB

Download
memory/4584-52-0x000002D3FD3D0000-0x000002D3FD3DA000-memory.dmp

Filesize
40KB

Download
memory/4584-15-0x00007FF8B91A3000-0x00007FF8B91A5000-memory.dmp

Filesize
8KB

Download
memory/4584-12-0x000002D3FCF30000-0x000002D3FCF50000-memory.dmp

Filesize
128KB

Download
memory/4584-144-0x00007FF8B91A3000-0x00007FF8B91A5000-memory.dmp

Filesize
8KB

Download
memory/4584-145-0x000002D3FF6D0000-0x000002D3FF879000-memory.dmp

Filesize
1.7MB

Download
memory/4584-146-0x00007FF8B91A0000-0x00007FF8B9C61000-memory.dmp

Filesize
10.8MB

Download
memory/4584-77-0x000002D3FF6D0000-0x000002D3FF879000-memory.dmp

Filesize
1.7MB

Download