Malware Analysis Report

2024-11-16 13:58

Sample ID 240621-camlqavgqb
Target a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9
SHA256 a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9
Tags
upx blackmoon banker trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9

Threat Level: Known bad

The file a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9 was found to be: Known bad.

Malicious Activity Summary

upx blackmoon banker trojan

Blackmoon, KrBanker

UPX dump on OEP (original entry point)

Detect Blackmoon payload

Blackmoon family

UPX dump on OEP (original entry point)

Loads dropped DLL

UPX packed file

Deletes itself

Checks computer location settings

Executes dropped EXE

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-21 01:52

Signatures

Blackmoon family

blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-21 01:52

Reported

2024-06-21 01:55

Platform

win7-20240419-en

Max time kernel

148s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe

"C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe"

C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe

"C:\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 i2.tietuku.com udp

Files

memory/1576-0-0x0000000000400000-0x000000000047F000-memory.dmp

\Users\Admin\AppData\Local\Temp\Syslemwejhn.exe

MD5 df66c8e462b2d31b8ae0d0ab9bd34aca
SHA1 7dc5017d1c32b6138e35f64615118c29ec5b8c78
SHA256 0510eb507aca57f527f59e81909f3cef4e763a1157e35b4bd9dcae9d71bfb3a7
SHA512 0f28c554a40d8bbc39a2972e03ce0a07819d01c4254a453d07422aa8163e7ce5d1734f81dfb00afa9153c7aca0855f3165207f1cbcd534f1a1a073d8345e4bbe

memory/1576-9-0x0000000000400000-0x000000000047F000-memory.dmp

memory/1576-15-0x0000000002B80000-0x0000000002BFF000-memory.dmp

memory/2744-17-0x0000000000400000-0x000000000047F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\lpath.ini

MD5 4ef3e771343e96efe159584d3443e44d
SHA1 c35cdf799d3050a312d82463240562af56e1efdd
SHA256 d90999f33e57288fcb6d7a7de2374cc540597af60ae31f264cfaa1443ec31559
SHA512 0a95b2bed81717095bd6ee0e3a428ce9a9d128cabcddb8c872ef49c713e4ee3f0b193cee8dc7be0e8a5310166ad81311abcc82154e4788a83234ef5137ba2beb

memory/2744-21-0x0000000000400000-0x000000000047F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-21 01:52

Reported

2024-06-21 01:55

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

51s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe

"C:\Users\Admin\AppData\Local\Temp\a5391f367b0b4aa3b822de7c55bdeb2f4876df4cba2b3a718c3cf68273b35ac9.exe"

C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe

"C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 i2.tietuku.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 i2.tietuku.com udp
US 8.8.8.8:53 i2.tietuku.com udp

Files

memory/4176-0-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4176-2-0x0000000000400000-0x000000000047F000-memory.dmp

memory/4176-4-0x0000000000400000-0x000000000047F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Syslemlfgdr.exe

MD5 ca4212d2b370fbd82141e254bc51bf72
SHA1 f917535ad47c49aaed46d1418f79a339fb242133
SHA256 4ae11d7632687b9beb3128dda5a54e95ca020ac62a26d6ae8be2a0560df1ef7d
SHA512 7bcb85d712cd166d50b874c5d6108b1e258ab31f0910a12dfd8b4b9241489cf27077cb134d2b2a089c66ec6bf86f077fdadded1fe75bd5542ce6ce5d9d48d127

memory/4176-16-0x0000000000400000-0x000000000047F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\lpath.ini

MD5 4ef3e771343e96efe159584d3443e44d
SHA1 c35cdf799d3050a312d82463240562af56e1efdd
SHA256 d90999f33e57288fcb6d7a7de2374cc540597af60ae31f264cfaa1443ec31559
SHA512 0a95b2bed81717095bd6ee0e3a428ce9a9d128cabcddb8c872ef49c713e4ee3f0b193cee8dc7be0e8a5310166ad81311abcc82154e4788a83234ef5137ba2beb

memory/2232-18-0x0000000000400000-0x000000000047F000-memory.dmp