Malware Analysis Report

2025-08-10 13:46

Sample ID 241017-xm4qzstcqm
Target 190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773
SHA256 190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773
Tags
blackmoon banker discovery trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773

Threat Level: Known bad

The file 190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773 was found to be: Known bad.

Malicious Activity Summary

blackmoon banker discovery trojan upx

Detect Blackmoon payload

Blackmoon, KrBanker

Deletes itself

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

UPX packed file

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-17 18:59

Signatures

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-17 18:59

Reported

2024-10-17 19:01

Platform

win7-20241010-en

Max time kernel

149s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe

"C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe"

C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe

"C:\Users\Admin\AppData\Local\Temp\Systemjgaly.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 i2.tietuku.com udp

Files

memory/2808-0-0x0000000000400000-0x000000000046B000-memory.dmp

memory/2808-7-0x0000000000400000-0x000000000046B000-memory.dmp

\Users\Admin\AppData\Local\Temp\Systemjgaly.exe

MD5 0abb8433b57987ef8b02ce2c28590303
SHA1 477b014cdd86a9b8c7eb0ed0b8a87a035acb8ab0
SHA256 9681cf15c0baf6e1f237cd62c88e34ecc99f3236e7566df21d6a097eee40f0db
SHA512 7aec78b45c846d02be9a6a5b9af6cd87f6a8083c996c025e20c1b9daf573654dc9977eb4b65125a393b0207deb22bb782fe000a9f8cae0a2bf037cc6c02ad205

memory/2808-15-0x00000000031D0000-0x000000000323B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fpath.ini

MD5 2b4159504c411ecc93fca80c5076184d
SHA1 ba1d6781ec9f229ee87228149a3e3d87f07752f0
SHA256 1a9fa5f0f9cd70cf19afea69f04cc367a26384d71409b67169b8f1f7ea025f5c
SHA512 93b99d6928b69b9378e164c869f8a095f47d921ef4d1f869ca89c550eacb6778eec22a184b7ede3d22c04ad326b3307d6e45b7b8c39538d1073c0ddd3549060d

memory/2716-20-0x0000000000400000-0x000000000046B000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-17 18:59

Reported

2024-10-17 19:01

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe"

Signatures

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe

"C:\Users\Admin\AppData\Local\Temp\190c1d3d1f171e6475c118d162e632e40d8ca596d0cd30df1052a6398e6f4773.exe"

C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe

"C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 i2.tietuku.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 76.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 75.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 101.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp

Files

memory/264-0-0x0000000000400000-0x000000000046B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Systemgjwhk.exe

MD5 e8fcd611ba50db3a2cf059de450754ae
SHA1 16c08b58b4a604da58815e0be21e6272e8afbf4e
SHA256 6185aefa12a2a66f7af14d5363c93cd587b58cf17dfe900a9bda052152647a93
SHA512 dce25f680d80fa498ad2b1583a7da7a39292b8677d326201b2fc1c675ac23bebb8230cc0497c8d67d0c3466b62e947505f530604df8b78516e10b82bd4b4bd7d

memory/264-14-0x0000000000400000-0x000000000046B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\fpath.ini

MD5 2b4159504c411ecc93fca80c5076184d
SHA1 ba1d6781ec9f229ee87228149a3e3d87f07752f0
SHA256 1a9fa5f0f9cd70cf19afea69f04cc367a26384d71409b67169b8f1f7ea025f5c
SHA512 93b99d6928b69b9378e164c869f8a095f47d921ef4d1f869ca89c550eacb6778eec22a184b7ede3d22c04ad326b3307d6e45b7b8c39538d1073c0ddd3549060d

memory/4960-17-0x0000000000400000-0x000000000046B000-memory.dmp