Resubmissions
11/04/2024, 09:38
240411-ll3lragg451011/04/2024, 09:38
240411-ll3azsbh8z1011/04/2024, 09:38
240411-ll2pfsgg441011/04/2024, 09:38
240411-ll2dpabh8x1011/04/2024, 09:37
240411-llsrjsbh8v1009/04/2024, 03:24
240409-dx2vlage811009/04/2024, 03:23
240409-dxjn1sda441016/01/2024, 16:35
240116-t3vapsehak10Analysis
- max time kernel
142s - max time network
156s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
16/01/2024, 16:35
General
- Target file.exe
- Size 234KB
- Sample240116-t3vapsehak
- SHA256 b4d9bc9471648ef8d072e524b4c6e3f5793e29b663bc85a9809912e7fad320c2
Malware Config
Extracted
-
smokeloader
-
2022
-
http://selebration17io.io/index.php
-
http://vacantion18ffeu.cc/index.php
-
http://valarioulinity1.net/index.php
-
http://buriatiarutuhuob.net/index.php
-
http://cassiosssionunu.me/index.php
-
http://sulugilioiu19.net/index.php
-
http://goodfooggooftool.net/index.php
-
http://gxutc2c.com/tmp/index.php
-
http://proekt8.ru/tmp/index.php
-
http://mth.com.ua/tmp/index.php
-
http://pirateking.online/tmp/index.php
-
http://piratia.pw/tmp/index.php
-
http://go-piratia.ru/tmp/index.php
Extracted
-
stealc
-
http://185.172.128.79
-
url_path
/3886d2276f6914c4.php
Signatures
- DcRat 3 IoCs
DarkCrystal(DC) is a new .NET RAT active since June 2019 capable of loading additional plugins.
- Detect ZGRat V1 1 IoCs
- Glupteba
Glupteba is a modular loader written in Golang with various components.
- Glupteba payload 3 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Stealc
Stealc is an infostealer written in C++.
- ZGRat
ZGRat is remote access trojan written in C#.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Downloads MZ/PE file
- Modifies Windows Firewall 1 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Drops startup file 1 IoCs
- Executes dropped EXE 20 IoCs
- Loads dropped DLL 7 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 3 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- DcRat
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\3C87.exeC:\Users\Admin\AppData\Local\Temp\3C87.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks computer location settings
- Drops startup file
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qemu-ga.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\41D7.exeC:\Users\Admin\AppData\Local\Temp\41D7.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\AppData\Local\Temp\4D13.exeC:\Users\Admin\AppData\Local\Temp\4D13.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\60AC.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\60AC.dll2⤵
- Loads dropped DLL
-
-
C:\Users\Admin\AppData\Local\Temp\81F1.exeC:\Users\Admin\AppData\Local\Temp\81F1.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\9F5D.exeC:\Users\Admin\AppData\Local\Temp\9F5D.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9F5D.exeC:\Users\Admin\AppData\Local\Temp\9F5D.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Local\Temp\AFE8.exeC:\Users\Admin\AppData\Local\Temp\AFE8.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\EE69.exeC:\Users\Admin\AppData\Local\Temp\EE69.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"C:\Users\Admin\AppData\Local\Temp\InstallSetup9.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Task.bat" "4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 12515⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn "MalayamaraUpdate" /tr "'C:\Users\Admin\AppData\Local\Temp\Updater.exe'" /sc minute /mo 30 /F5⤵
- DcRat
- Creates scheduled task(s)
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\nsz27E3.tmpC:\Users\Admin\AppData\Local\Temp\nsz27E3.tmp3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\nsz27E3.tmp" & del "C:\ProgramData\*.dll"" & exit4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 55⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 24524⤵
- Program crash
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"C:\Users\Admin\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe"3⤵
- Executes dropped EXE
- Checks for VirtualBox DLLs, possible anti-VM trick
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"4⤵
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes5⤵
- Modifies Windows Firewall
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe4⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F5⤵
- DcRat
- Creates scheduled task(s)
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f5⤵
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1556 -s 6163⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\1ACA.exeC:\Users\Admin\AppData\Local\Temp\1ACA.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NJIU3.tmp\is-SD6BE.tmp"C:\Users\Admin\AppData\Local\Temp\is-NJIU3.tmp\is-SD6BE.tmp" /SL4 $601BC "C:\Users\Admin\AppData\Local\Temp\1ACA.exe" 9508382 522242⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Delete /F /TN "UCR1163"3⤵
-
-
C:\Users\Admin\AppData\Local\HramSoft\Ree Audio Converter\UdioConverterRipper.exe"C:\Users\Admin\AppData\Local\HramSoft\Ree Audio Converter\UdioConverterRipper.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\HramSoft\Ree Audio Converter\UdioConverterRipper.exe"C:\Users\Admin\AppData\Local\HramSoft\Ree Audio Converter\UdioConverterRipper.exe" -s3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Local\Temp\37A9.exeC:\Users\Admin\AppData\Local\Temp\37A9.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1556 -ip 15561⤵
-
C:\Users\Admin\AppData\Local\Temp\ADA5.exeC:\Users\Admin\AppData\Local\Temp\ADA5.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2132 -ip 21321⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Defense Evasion
Modify Registry
1Pre-OS Boot
1Bootkit
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
Are.docx
mozglue.dll
nss3.dll
UdioConverterRipper.exe
UdioConverterRipper.exe
UdioConverterRipper.exe
is-KE28P.tmp
1ACA.exe
1ACA.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
288c47bbc1871b439df19ff4df68f076.exe
37A9.exe
3C87.exe
41D7.exe
4D13.exe
60AC.dll
81F1.exe
81F1.exe
9F5D.exe
9F5D.exe
ADA5.exe
AFE8.exe
BroomSetup.exe
EE69.exe
InstallSetup9.exe
__PSScriptPolicyTest_jeebus1b.suy.ps1
is-SD6BE.tmp
_iscrypt.dll
INetC.dll
nsz27E3.tmp
qemu-ga.exe
Task.bat
powershell.exe.log
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
StartupProfileData-Interactive
memory/628-108-0x00000000020A0000-0x000000000210B000-memory.dmp
memory/628-75-0x0000000000400000-0x0000000000491000-memory.dmp
memory/628-50-0x0000000000400000-0x0000000000491000-memory.dmp
memory/628-48-0x0000000000400000-0x0000000000491000-memory.dmp
memory/628-46-0x0000000000400000-0x0000000000491000-memory.dmp
memory/628-43-0x00000000020A0000-0x000000000210B000-memory.dmp
memory/628-107-0x0000000000520000-0x0000000000620000-memory.dmp
memory/628-42-0x0000000000520000-0x0000000000620000-memory.dmp
memory/656-479-0x0000000000400000-0x0000000000413000-memory.dmp
memory/656-162-0x0000000000400000-0x0000000000413000-memory.dmp
memory/1200-76-0x0000000000580000-0x0000000000581000-memory.dmp
memory/1200-78-0x0000000000C10000-0x00000000014C4000-memory.dmp
memory/1200-77-0x0000000000C10000-0x00000000014C4000-memory.dmp
memory/1200-109-0x0000000000C10000-0x00000000014C4000-memory.dmp
memory/1200-82-0x0000000000670000-0x0000000000671000-memory.dmp
memory/1200-83-0x0000000000670000-0x0000000000671000-memory.dmp
memory/1200-84-0x0000000000670000-0x0000000000671000-memory.dmp
memory/1416-91-0x0000000000050000-0x0000000000566000-memory.dmp
memory/1416-38-0x0000000002AF0000-0x0000000002AF1000-memory.dmp
memory/1416-54-0x0000000000050000-0x0000000000566000-memory.dmp
memory/1416-36-0x0000000000050000-0x0000000000566000-memory.dmp
memory/1508-136-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/1508-119-0x00000000747C0000-0x0000000074F70000-memory.dmp
memory/1508-117-0x0000000000550000-0x0000000000B3E000-memory.dmp
memory/1556-389-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/1556-139-0x00000000029B0000-0x0000000002DAA000-memory.dmp
memory/1556-141-0x0000000002DB0000-0x000000000369B000-memory.dmp
memory/1556-353-0x00000000029B0000-0x0000000002DAA000-memory.dmp
memory/1556-142-0x0000000000400000-0x0000000000D1C000-memory.dmp
memory/2060-146-0x00000000027F0000-0x00000000029B4000-memory.dmp
memory/2060-152-0x00000000029C0000-0x0000000002B77000-memory.dmp
memory/2132-385-0x0000000000780000-0x000000000079C000-memory.dmp
memory/2132-388-0x0000000000400000-0x000000000062E000-memory.dmp
memory/2132-374-0x0000000000930000-0x0000000000A30000-memory.dmp
memory/2132-502-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/2620-181-0x00000000021F0000-0x00000000021F1000-memory.dmp
memory/2620-485-0x0000000000400000-0x00000000004B0000-memory.dmp
memory/3372-491-0x00000000030F0000-0x0000000003106000-memory.dmp
memory/3372-5-0x00000000014A0000-0x00000000014B6000-memory.dmp
memory/4064-462-0x0000000000400000-0x00000000008FD000-memory.dmp
memory/4064-471-0x0000000000400000-0x00000000008FD000-memory.dmp
memory/4372-468-0x0000000010000000-0x0000000010236000-memory.dmp
memory/4372-452-0x0000000002DD0000-0x0000000002EE0000-memory.dmp
memory/4372-480-0x0000000002DD0000-0x0000000002EE0000-memory.dmp
memory/4372-445-0x0000000002CA0000-0x0000000002DCD000-memory.dmp
memory/4372-145-0x0000000000400000-0x0000000000848000-memory.dmp
memory/4372-148-0x0000000000400000-0x0000000000848000-memory.dmp
memory/4372-166-0x0000000000400000-0x0000000000848000-memory.dmp
memory/4372-167-0x0000000000400000-0x0000000000848000-memory.dmp
memory/4372-174-0x0000000000EB0000-0x0000000000EB6000-memory.dmp
memory/4372-477-0x0000000002DD0000-0x0000000002EE0000-memory.dmp
memory/4372-157-0x0000000000400000-0x0000000000848000-memory.dmp
memory/4372-153-0x0000000000400000-0x0000000000848000-memory.dmp
memory/4372-472-0x0000000002DD0000-0x0000000002EE0000-memory.dmp
memory/4452-57-0x0000000075180000-0x0000000075270000-memory.dmp
memory/4452-49-0x0000000075180000-0x0000000075270000-memory.dmp
memory/4452-103-0x0000000008BC0000-0x00000000090EC000-memory.dmp
memory/4452-102-0x0000000007D90000-0x0000000007F52000-memory.dmp
memory/4452-101-0x0000000008640000-0x0000000008690000-memory.dmp
memory/4452-100-0x00000000068D0000-0x00000000068EE000-memory.dmp
memory/4452-99-0x00000000067A0000-0x0000000006816000-memory.dmp
memory/4452-98-0x0000000006700000-0x0000000006792000-memory.dmp
memory/4452-97-0x0000000006BF0000-0x0000000007194000-memory.dmp
memory/4452-92-0x0000000005BD0000-0x0000000005C36000-memory.dmp
memory/4452-89-0x0000000005860000-0x00000000058AC000-memory.dmp
memory/4452-81-0x0000000005800000-0x000000000583C000-memory.dmp
memory/4452-79-0x0000000075180000-0x0000000075270000-memory.dmp
memory/4452-74-0x0000000075180000-0x0000000075270000-memory.dmp
memory/4452-73-0x0000000075180000-0x0000000075270000-memory.dmp
memory/4452-71-0x0000000005910000-0x0000000005A1A000-memory.dmp
memory/4452-23-0x0000000075180000-0x0000000075270000-memory.dmp
memory/4452-69-0x0000000005790000-0x00000000057A2000-memory.dmp
memory/4452-24-0x0000000075180000-0x0000000075270000-memory.dmp
memory/4452-26-0x0000000075180000-0x0000000075270000-memory.dmp
memory/4452-65-0x0000000005E20000-0x0000000006438000-memory.dmp
memory/4452-27-0x0000000075180000-0x0000000075270000-memory.dmp
memory/4452-21-0x0000000075180000-0x0000000075270000-memory.dmp
memory/4452-25-0x0000000075180000-0x0000000075270000-memory.dmp
memory/4452-28-0x00000000772D4000-0x00000000772D6000-memory.dmp
memory/4452-56-0x0000000075180000-0x0000000075270000-memory.dmp
memory/4452-39-0x00000000006A0000-0x0000000000EBA000-memory.dmp
memory/4452-16-0x00000000006A0000-0x0000000000EBA000-memory.dmp
memory/4452-22-0x0000000075180000-0x0000000075270000-memory.dmp
memory/4452-47-0x0000000075180000-0x0000000075270000-memory.dmp
memory/4452-41-0x00000000006A0000-0x0000000000EBA000-memory.dmp
memory/4456-470-0x0000000000400000-0x00000000008E2000-memory.dmp
memory/4456-163-0x0000000002580000-0x0000000002581000-memory.dmp
memory/4528-1-0x00000000007D0000-0x00000000008D0000-memory.dmp
memory/4528-9-0x00000000005D0000-0x00000000005DB000-memory.dmp
memory/4528-6-0x0000000000400000-0x0000000000440000-memory.dmp
memory/4528-4-0x0000000000400000-0x0000000000440000-memory.dmp
memory/4528-3-0x0000000000400000-0x0000000000440000-memory.dmp
memory/4528-2-0x00000000005D0000-0x00000000005DB000-memory.dmp
memory/4840-58-0x0000000000880000-0x0000000000886000-memory.dmp
memory/4840-53-0x0000000010000000-0x0000000010236000-memory.dmp
memory/4840-60-0x0000000002700000-0x000000000282D000-memory.dmp
memory/4840-64-0x0000000002830000-0x0000000002940000-memory.dmp
memory/4840-66-0x0000000002830000-0x0000000002940000-memory.dmp
memory/4840-68-0x0000000002830000-0x0000000002940000-memory.dmp
memory/4840-70-0x0000000002830000-0x0000000002940000-memory.dmp
memory/5116-493-0x0000000000400000-0x000000000043F000-memory.dmp