Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    30/07/2021, 15:26

General

  • Target
    E39A5FA4C76264AE7D7343E41675A636.exe
  • Size 2.6MB
  • Sample210730-bezpcqbbcn
  • SHA256 d72dd5663947fc7e1bd8903030b3e2fd551d8d938fdc6417d8513a1c4cc49702
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • vidar

Version
  • 39.7

Botnet
  • 933

C2
  • https://shpak125.tumblr.com/

Attributes
  • profile_id

    933

Extracted

Family
  • smokeloader

Version
  • 2020

C2
  • http://conceitosseg.com/upload/

  • http://integrasidata.com/upload/

  • http://ozentekstil.com/upload/

  • http://finbelportal.com/upload/

  • http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
  • Nirsoft 7 IoCs
  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 8 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 19 IoCs
  • Loads dropped DLL 9 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 5 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 24 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s SENS
    1⤵
      PID:1400
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
      1⤵
        PID:2556
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2788
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s WpnService
        1⤵
          PID:2796
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Browser
          1⤵
            PID:2748
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2520
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1872
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s UserManager
              1⤵
                PID:1360
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                1⤵
                • Modifies registry class
                PID:1176
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                1⤵
                  PID:1100
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                  1⤵
                  • Drops file in System32 directory
                  PID:1052
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                  1⤵
                    PID:300
                  • C:\Users\Admin\AppData\Local\Temp\E39A5FA4C76264AE7D7343E41675A636.exe
                    "C:\Users\Admin\AppData\Local\Temp\E39A5FA4C76264AE7D7343E41675A636.exe"
                    1⤵
                    • Suspicious use of WriteProcessMemory
                    PID:904
                    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
                      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
                      2⤵
                      • Executes dropped EXE
                      • Suspicious use of WriteProcessMemory
                      PID:3688
                      • C:\Users\Admin\AppData\Local\Temp\7zS86EF3094\setup_install.exe
                        "C:\Users\Admin\AppData\Local\Temp\7zS86EF3094\setup_install.exe"
                        3⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Suspicious use of WriteProcessMemory
                        PID:636
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sonia_1.exe
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:1340
                          • C:\Users\Admin\AppData\Local\Temp\7zS86EF3094\sonia_1.exe
                            sonia_1.exe
                            5⤵
                            • Executes dropped EXE
                            • Suspicious use of WriteProcessMemory
                            PID:3844
                            • C:\Users\Admin\AppData\Local\Temp\7zS86EF3094\sonia_1.exe
                              "C:\Users\Admin\AppData\Local\Temp\7zS86EF3094\sonia_1.exe" -a
                              6⤵
                              • Executes dropped EXE
                              PID:3220
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sonia_2.exe
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2292
                          • C:\Users\Admin\AppData\Local\Temp\7zS86EF3094\sonia_2.exe
                            sonia_2.exe
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Checks SCSI registry key(s)
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious behavior: MapViewOfSection
                            PID:3840
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c sonia_3.exe
                          4⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2084
                          • C:\Users\Admin\AppData\Local\Temp\7zS86EF3094\sonia_3.exe
                            sonia_3.exe
                            5⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            • Checks processor information in registry
                            PID:3628
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /c taskkill /im sonia_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS86EF3094\sonia_3.exe" & del C:\ProgramData\*.dll & exit
                              6⤵
                                PID:4232
                                • C:\Windows\SysWOW64\taskkill.exe
                                  taskkill /im sonia_3.exe /f
                                  7⤵
                                  • Kills process with taskkill
                                  PID:2988
                                • C:\Windows\SysWOW64\timeout.exe
                                  timeout /t 6
                                  7⤵
                                  • Delays execution with timeout.exe
                                  PID:5112
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c sonia_4.exe
                            4⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2116
                            • C:\Users\Admin\AppData\Local\Temp\7zS86EF3094\sonia_4.exe
                              sonia_4.exe
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3836
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c sonia_5.exe
                            4⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1572
                            • C:\Users\Admin\AppData\Local\Temp\7zS86EF3094\sonia_5.exe
                              sonia_5.exe
                              5⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:2324
                              • C:\Users\Admin\AppData\Roaming\4932736.exe
                                "C:\Users\Admin\AppData\Roaming\4932736.exe"
                                6⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4088
                                • C:\Windows\system32\WerFault.exe
                                  C:\Windows\system32\WerFault.exe -u -p 4088 -s 1912
                                  7⤵
                                  • Program crash
                                  PID:5116
                              • C:\Users\Admin\AppData\Roaming\2647201.exe
                                "C:\Users\Admin\AppData\Roaming\2647201.exe"
                                6⤵
                                • Executes dropped EXE
                                • Adds Run key to start application
                                PID:2460
                                • C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
                                  "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
                                  7⤵
                                  • Executes dropped EXE
                                  PID:5104
                              • C:\Users\Admin\AppData\Roaming\8806792.exe
                                "C:\Users\Admin\AppData\Roaming\8806792.exe"
                                6⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3168
                              • C:\Users\Admin\AppData\Roaming\7218898.exe
                                "C:\Users\Admin\AppData\Roaming\7218898.exe"
                                6⤵
                                • Executes dropped EXE
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4148
                                • C:\Windows\SysWOW64\WerFault.exe
                                  C:\Windows\SysWOW64\WerFault.exe -u -p 4148 -s 2032
                                  7⤵
                                  • Program crash
                                  PID:4468
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c sonia_6.exe
                            4⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2212
                            • C:\Users\Admin\AppData\Local\Temp\7zS86EF3094\sonia_6.exe
                              sonia_6.exe
                              5⤵
                              • Executes dropped EXE
                              PID:3900
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 1108
                                6⤵
                                • Program crash
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4576
                              • C:\Windows\SysWOW64\WerFault.exe
                                C:\Windows\SysWOW64\WerFault.exe -u -p 3900 -s 1348
                                6⤵
                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                • Program crash
                                PID:4608
                          • C:\Windows\SysWOW64\cmd.exe
                            C:\Windows\system32\cmd.exe /c sonia_7.exe
                            4⤵
                            • Suspicious use of WriteProcessMemory
                            PID:368
                            • C:\Users\Admin\AppData\Local\Temp\7zS86EF3094\sonia_7.exe
                              sonia_7.exe
                              5⤵
                              • Executes dropped EXE
                              PID:3964
                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                6⤵
                                • Executes dropped EXE
                                PID:496
                              • C:\Users\Admin\AppData\Local\Temp\11111.exe
                                C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                6⤵
                                • Executes dropped EXE
                                PID:4988
                              • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                6⤵
                                • Executes dropped EXE
                                PID:4476
                              • C:\Users\Admin\AppData\Local\Temp\22222.exe
                                C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                                6⤵
                                • Executes dropped EXE
                                PID:3844
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 532
                            4⤵
                            • Program crash
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2280
                    • \??\c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s BITS
                      1⤵
                      • Suspicious use of SetThreadContext
                      • Modifies registry class
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1380
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                        2⤵
                        • Checks processor information in registry
                        • Modifies data under HKEY_USERS
                        • Modifies registry class
                        PID:4448
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k SystemNetworkService
                        2⤵
                        • Drops file in System32 directory
                        • Checks processor information in registry
                        • Modifies data under HKEY_USERS
                        • Modifies registry class
                        PID:4716
                    • C:\Windows\system32\rUNdlL32.eXe
                      rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                      1⤵
                      • Process spawned unexpected child process
                      • Suspicious use of WriteProcessMemory
                      PID:4280
                      • C:\Windows\SysWOW64\rundll32.exe
                        rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                        2⤵
                        • Loads dropped DLL
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:4312

                    Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          memory/300-335-0x000001D60EFA0000-0x000001D60F014000-memory.dmp

                          memory/300-226-0x000001D60EEB0000-0x000001D60EF21000-memory.dmp

                          memory/496-284-0x0000000000400000-0x0000000000455000-memory.dmp

                          memory/636-133-0x0000000064940000-0x0000000064959000-memory.dmp

                          memory/636-135-0x0000000000400000-0x000000000051D000-memory.dmp

                          memory/636-132-0x000000006B280000-0x000000006B2A6000-memory.dmp

                          memory/636-131-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                          memory/636-130-0x000000006B440000-0x000000006B4CF000-memory.dmp

                          memory/636-136-0x0000000064940000-0x0000000064959000-memory.dmp

                          memory/636-137-0x0000000064940000-0x0000000064959000-memory.dmp

                          memory/636-134-0x0000000064940000-0x0000000064959000-memory.dmp

                          memory/1052-348-0x0000020CBFED0000-0x0000020CBFF44000-memory.dmp

                          memory/1052-267-0x0000020CBFE50000-0x0000020CBFEC1000-memory.dmp

                          memory/1100-265-0x000001E936500000-0x000001E936571000-memory.dmp

                          memory/1100-347-0x000001E936BE0000-0x000001E936C54000-memory.dmp

                          memory/1176-272-0x000001D8B8D20000-0x000001D8B8D91000-memory.dmp

                          memory/1176-351-0x000001D8B92A0000-0x000001D8B9314000-memory.dmp

                          memory/1360-352-0x0000023B8D110000-0x0000023B8D184000-memory.dmp

                          memory/1360-275-0x0000023B8CB70000-0x0000023B8CBE1000-memory.dmp

                          memory/1380-233-0x000002234B890000-0x000002234B8DC000-memory.dmp

                          memory/1380-330-0x00000223493E0000-0x00000223493E4000-memory.dmp

                          memory/1380-326-0x000002234B5C0000-0x000002234B5C4000-memory.dmp

                          memory/1380-236-0x000002234B950000-0x000002234B9C1000-memory.dmp

                          memory/1380-328-0x00000223493F0000-0x00000223493F4000-memory.dmp

                          memory/1380-327-0x00000223493F0000-0x00000223493F1000-memory.dmp

                          memory/1400-349-0x00000244789B0000-0x0000024478A24000-memory.dmp

                          memory/1400-268-0x0000024478380000-0x00000244783F1000-memory.dmp

                          memory/1872-350-0x000001B9F2970000-0x000001B9F29E4000-memory.dmp

                          memory/1872-269-0x000001B9F2860000-0x000001B9F28D1000-memory.dmp

                          memory/2324-168-0x00000000003F0000-0x00000000003F1000-memory.dmp

                          memory/2324-171-0x0000000000850000-0x0000000000866000-memory.dmp

                          memory/2324-172-0x000000001AEA0000-0x000000001AEA2000-memory.dmp

                          memory/2460-209-0x0000000001230000-0x0000000001238000-memory.dmp

                          memory/2460-193-0x00000000008F0000-0x00000000008F1000-memory.dmp

                          memory/2460-212-0x0000000007B10000-0x0000000007B11000-memory.dmp

                          memory/2460-221-0x00000000076B0000-0x00000000076B1000-memory.dmp

                          memory/2520-237-0x000001C8E7840000-0x000001C8E78B1000-memory.dmp

                          memory/2520-346-0x000001C8E7930000-0x000001C8E79A4000-memory.dmp

                          memory/2556-230-0x000001B527B80000-0x000001B527BF1000-memory.dmp

                          memory/2556-336-0x000001B528110000-0x000001B528184000-memory.dmp

                          memory/2644-287-0x0000000000CE0000-0x0000000000CF5000-memory.dmp

                          memory/2748-334-0x00000203D3A90000-0x00000203D3B04000-memory.dmp

                          memory/2748-239-0x00000203D3A10000-0x00000203D3A81000-memory.dmp

                          memory/2788-276-0x000001E1DFE40000-0x000001E1DFEB1000-memory.dmp

                          memory/2788-353-0x000001E1E0330000-0x000001E1E03A4000-memory.dmp

                          memory/2796-354-0x0000028C4AAC0000-0x0000028C4AB34000-memory.dmp

                          memory/2796-278-0x0000028C4A700000-0x0000028C4A771000-memory.dmp

                          memory/3168-274-0x0000000005040000-0x0000000005041000-memory.dmp

                          memory/3168-225-0x000000000DEE0000-0x000000000DEE1000-memory.dmp

                          memory/3168-208-0x0000000001060000-0x0000000001061000-memory.dmp

                          memory/3168-213-0x0000000005000000-0x000000000503A000-memory.dmp

                          memory/3168-279-0x000000000DB80000-0x000000000DB81000-memory.dmp

                          memory/3168-232-0x0000000002850000-0x0000000002851000-memory.dmp

                          memory/3168-256-0x000000000D950000-0x000000000D951000-memory.dmp

                          memory/3168-217-0x0000000001080000-0x0000000001081000-memory.dmp

                          memory/3168-241-0x000000000D910000-0x000000000D911000-memory.dmp

                          memory/3168-192-0x0000000000680000-0x0000000000681000-memory.dmp

                          memory/3628-203-0x00000000025C0000-0x000000000265D000-memory.dmp

                          memory/3628-204-0x0000000000400000-0x00000000008F9000-memory.dmp

                          memory/3836-170-0x000000001B470000-0x000000001B472000-memory.dmp

                          memory/3836-166-0x00000000006D0000-0x00000000006D1000-memory.dmp

                          memory/3840-201-0x00000000001D0000-0x00000000001D9000-memory.dmp

                          memory/3840-202-0x0000000000400000-0x000000000089D000-memory.dmp

                          memory/3964-244-0x0000022B94880000-0x0000022B94950000-memory.dmp

                          memory/3964-238-0x0000022B94810000-0x0000022B9487F000-memory.dmp

                          memory/4088-180-0x0000000000640000-0x0000000000641000-memory.dmp

                          memory/4088-191-0x0000000000B80000-0x0000000000B81000-memory.dmp

                          memory/4088-242-0x000000001B300000-0x000000001B302000-memory.dmp

                          memory/4088-186-0x0000000000B70000-0x0000000000B71000-memory.dmp

                          memory/4088-190-0x0000000002580000-0x00000000025B3000-memory.dmp

                          memory/4148-296-0x0000000008B10000-0x0000000008B11000-memory.dmp

                          memory/4148-207-0x0000000002E60000-0x0000000002E61000-memory.dmp

                          memory/4148-243-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

                          memory/4148-194-0x0000000000BF0000-0x0000000000BF1000-memory.dmp

                          memory/4148-234-0x0000000004E80000-0x0000000004EB2000-memory.dmp

                          memory/4148-270-0x00000000054D0000-0x00000000054D1000-memory.dmp

                          memory/4148-286-0x0000000008480000-0x0000000008481000-memory.dmp

                          memory/4312-228-0x0000000003040000-0x000000000309D000-memory.dmp

                          memory/4312-222-0x0000000004585000-0x0000000004686000-memory.dmp

                          memory/4448-224-0x0000021352580000-0x00000213525F1000-memory.dmp

                          memory/4716-305-0x0000025C434D0000-0x0000025C43544000-memory.dmp

                          memory/4716-304-0x0000025C431C0000-0x0000025C4320E000-memory.dmp

                          memory/4716-325-0x0000025C45C00000-0x0000025C45D06000-memory.dmp

                          memory/4716-324-0x0000025C44CF0000-0x0000025C44D0B000-memory.dmp

                          memory/5104-285-0x0000000004F40000-0x0000000004F41000-memory.dmp

                          memory/5104-280-0x0000000007DA0000-0x0000000007DA1000-memory.dmp