Malware Analysis Report

2024-11-13 18:01

Sample ID 241110-abqcwsvfmf
Target 83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c
SHA256 83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c
Tags
upx blackmoon banker discovery trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c

Threat Level: Known bad

The file 83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c was found to be: Known bad.

Malicious Activity Summary

upx blackmoon banker discovery trojan

Blackmoon family

Detect Blackmoon payload

Blackmoon, KrBanker

Loads dropped DLL

Checks computer location settings

Deletes itself

Executes dropped EXE

UPX packed file

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-10 00:02

Signatures

Blackmoon family

blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-10 00:02

Reported

2024-11-10 00:05

Platform

win7-20240903-en

Max time kernel

148s

Max time network

119s

Command Line

"C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe"

Signatures

Blackmoon family

blackmoon

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe

"C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe"

C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe

"C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 i2.tietuku.com udp

Files

memory/1796-0-0x0000000000400000-0x000000000047F000-memory.dmp

memory/1796-7-0x0000000000400000-0x000000000047F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Syslemxiizw.exe

MD5 097b4977bfe6714bf0712dcb65c14b03
SHA1 c01bb385d15a7b050ad969479a0220b0e95fda9a
SHA256 3e6afb658c6a236dfdf53b45e4c4d93b089c928c7f4c2bc3b1de9fb9b4b357af
SHA512 c0f4d46e722a7d3152efaa343aea9f808c1b6e0f9403f56d581d0e787638b5b3d1f6ebf70d712e01edd7d8f26f15f18fe0ae737b855f133fec4d4ee88916649f

memory/2784-17-0x0000000000400000-0x000000000047F000-memory.dmp

memory/1796-15-0x00000000037D0000-0x000000000384F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\lpath.ini

MD5 f89bb0954242fa3816f9e8d05b3cec36
SHA1 e09be2a100c80b49e5600eb29cd3a2bc06a827d2
SHA256 cd1ac67cb37d864d9444c5d8f0ad6c37a14c25b3eb438af50d67b31fd0af4921
SHA512 a225f6403900c9737f72691a5b800a4db5810d8cf254d4f0888ae4f7d5b0ab1aed02a02f4a34c3ed60d9cc84a48a9a057fdcb5f0c1f684890188bb03be902c55

memory/2784-21-0x0000000000400000-0x000000000047F000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-10 00:02

Reported

2024-11-10 00:05

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

134s

Command Line

"C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe"

Signatures

Blackmoon family

blackmoon

Blackmoon, KrBanker

trojan banker blackmoon

Detect Blackmoon payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A

Deletes itself

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe

"C:\Users\Admin\AppData\Local\Temp\83fd3c691931b6cfee538eb0f688ac14a06a2715a1d7b9970ccba22c52b1a85c.exe"

C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe

"C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 i2.tietuku.com udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 0.205.248.87.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

memory/1492-0-0x0000000000400000-0x000000000047F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Syslemwdqju.exe

MD5 670401416ac7359cdd2118d19b92424d
SHA1 61a3245e3d26b07a8fe8470ee17d1c145da65758
SHA256 d543ff9be454e50ab10d8ed6e7454db087c16fd6ce464b4f71a6366173fc1a79
SHA512 728f9f304f97147632d337e20e793c96d03abd41c1ddeae327a80c4c07fec150615eca634280a0d302eac17d55b32125ccfa71e77afc4f7a1f18c353b60b1f94

memory/1492-14-0x0000000000400000-0x000000000047F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\lpath.ini

MD5 f89bb0954242fa3816f9e8d05b3cec36
SHA1 e09be2a100c80b49e5600eb29cd3a2bc06a827d2
SHA256 cd1ac67cb37d864d9444c5d8f0ad6c37a14c25b3eb438af50d67b31fd0af4921
SHA512 a225f6403900c9737f72691a5b800a4db5810d8cf254d4f0888ae4f7d5b0ab1aed02a02f4a34c3ed60d9cc84a48a9a057fdcb5f0c1f684890188bb03be902c55

memory/4496-16-0x0000000000400000-0x000000000047F000-memory.dmp