Analysis
- max time kernel
4s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240611-en - submitted
15/06/2024, 20:14
General
- Target 328c280dc24eac250716dc12e4180a56148fc7ad167680e9cf39ff2f1bb71414.exe
- Size 3.2MB
- Sample240615-y1akqsshph
- SHA256 328c280dc24eac250716dc12e4180a56148fc7ad167680e9cf39ff2f1bb71414
Malware Config
Extracted
-
xred
-
xred.mooo.com
-
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
http://xred.site50.net/syn/SUpdate.ini
https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
http://xred.site50.net/syn/Synaptics.rar
https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
http://xred.site50.net/syn/SSLLibrary.dll
Signatures
- Detect Neshta payload 64 IoCs
- Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Neshta family
- Xred
Xred is backdoor written in Delphi.
- Xred family
- Checks computer location settings 2 TTPs 8 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 11 IoCs
- Modifies system executable filetype association 2 TTPs 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 8 IoCs
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious use of AdjustPrivilegeToken 15 IoCs
- Suspicious use of WriteProcessMemory 33 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\328c280dc24eac250716dc12e4180a56148fc7ad167680e9cf39ff2f1bb71414.exe"C:\Users\Admin\AppData\Local\Temp\328c280dc24eac250716dc12e4180a56148fc7ad167680e9cf39ff2f1bb71414.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_328c280dc24eac250716dc12e4180a56148fc7ad167680e9cf39ff2f1bb71414.exe"C:\Users\Admin\AppData\Local\Temp\._cache_328c280dc24eac250716dc12e4180a56148fc7ad167680e9cf39ff2f1bb71414.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_328c280dc24eac250716dc12e4180a56148fc7ad167680e9cf39ff2f1bb71414.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_328c280dc24eac250716dc12e4180a56148fc7ad167680e9cf39ff2f1bb71414.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_._cache_328c280dc24eac250716dc12e4180a56148fc7ad167680e9cf39ff2f1bb71414.exe"C:\Users\Admin\AppData\Local\Temp\._cache_._cache_328c280dc24eac250716dc12e4180a56148fc7ad167680e9cf39ff2f1bb71414.exe"4⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE"5⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE6⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE"7⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C1267~1.EXE"8⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C1267~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C1267~1.EXE9⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__C1267~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C1267~1.EXE"10⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE"11⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE12⤵
-
-
-
-
-
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate4⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate5⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~2.EXE" InjUpdate6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE" InjUpdate7⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~4.EXE InjUpdate8⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~4.EXE" InjUpdate9⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE" InjUpdate10⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~1.EXE InjUpdate11⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~1.EXE" InjUpdate12⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C77FE~1.EXE" InjUpdate13⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C77FE~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C77FE~1.EXE InjUpdate14⤵
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate12⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate13⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate14⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate15⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate16⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C1267~1.EXE" InjUpdate17⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C1267~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C1267~1.EXE InjUpdate18⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__C1267~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C1267~1.EXE" InjUpdate19⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate20⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate21⤵
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate19⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate20⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate21⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate22⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate23⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C1267~1.EXE" InjUpdate24⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C1267~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C1267~1.EXE InjUpdate25⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__C1267~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C1267~1.EXE" InjUpdate26⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate27⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate28⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate16⤵
-
-
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate9⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate10⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate11⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate12⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate13⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_C1267~1.EXE" InjUpdate14⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_C1267~1.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_C1267~1.EXE InjUpdate15⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__C1267~1.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__C1267~1.EXE" InjUpdate16⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE" InjUpdate17⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~2.EXE InjUpdate18⤵
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate16⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate17⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE" InjUpdate18⤵
-
C:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXEC:\Users\Admin\AppData\Local\Temp\3582-490\_CACHE~3.EXE InjUpdate19⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE"C:\Users\Admin\AppData\Local\Temp\._cache__CACHE~3.EXE" InjUpdate20⤵
-
-
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate13⤵
-
-
-
-
-
-
-
-
-
C:\ProgramData\Synaptics\Synaptics.exe"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate6⤵
-
C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe"C:\Users\Admin\AppData\Local\Temp\._cache_Synaptics.exe" InjUpdate7⤵
-
C:\Windows\svchost.com"C:\Windows\svchost.com" "C:\Users\Admin\AppData\Local\Temp\3582-490\._cache_Synaptics.exe" InjUpdate8⤵
-
-
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4452,i,8998666007764333392,14724298544432336038,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
ACROBR~1.EXE
ACROTE~1.EXE
ADOBEC~1.EXE
ADelRCP.exe
RdrCEF.exe
AcroRd32.exe
WCCHRO~1.EXE
Eula.exe
FULLTR~1.EXE
LOGTRA~1.EXE
READER~1.EXE
WOW_HE~1.EXE
arh.exe
32BITM~1.EXE
64BITM~1.EXE
ADOBEA~1.EXE
AdobeARM.exe
jaureg.exe
jucheck.exe
jusched.exe
VSTOIN~1.EXE
java.exe
javaw.exe
GOBD5D~1.EXE
GOF5E2~1.EXE
GOOGLE~2.EXE
GOOGLE~4.EXE
DISABL~1.EXE
MICROS~3.EXE
MSEDGE~3.EXE
PWAHEL~1.EXE
msedge.exe
ie_to_edge_stub.exe
setup.exe
cookie_exporter.exe
elevation_service.exe
identity_helper.exe
msedge_proxy.exe
msedgewebview2.exe
notification_click_helper.exe
RCXED7D.tmp
Synaptics.exe
._cache_._cache_328c280dc24eac250716dc12e4180a56148fc7ad167680e9cf39ff2f1bb71414.exe
._cache_328c280dc24eac250716dc12e4180a56148fc7ad167680e9cf39ff2f1bb71414.exe
._cache_._cache_328c280dc24eac250716dc12e4180a56148fc7ad167680e9cf39ff2f1bb71414.exe
._cache_328c280dc24eac250716dc12e4180a56148fc7ad167680e9cf39ff2f1bb71414.exe
._cache__C1267~1.EXE
._cache__CACHE~3.EXE
directx.sys
directx.sys
svchost.com
memory/412-511-0x0000000000400000-0x000000000041B000-memory.dmp
memory/860-775-0x0000000000400000-0x000000000041B000-memory.dmp
memory/872-577-0x0000000000400000-0x00000000004E4000-memory.dmp
memory/968-924-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1612-796-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1660-802-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1688-891-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1696-805-0x0000000000400000-0x00000000004E4000-memory.dmp
memory/1696-664-0x0000000000400000-0x0000000000671000-memory.dmp
memory/1744-778-0x0000000000400000-0x00000000004E4000-memory.dmp
memory/1756-576-0x0000000000400000-0x00000000005AB000-memory.dmp
memory/1780-234-0x0000000000400000-0x000000000041B000-memory.dmp
memory/1792-665-0x0000000000400000-0x0000000000671000-memory.dmp
memory/1864-507-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2080-807-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2224-806-0x0000000000400000-0x00000000004E4000-memory.dmp
memory/2268-609-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2272-615-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2288-901-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2352-892-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2464-103-0x00000000009D0000-0x00000000009D1000-memory.dmp
memory/2464-909-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2464-395-0x0000000000400000-0x0000000000738000-memory.dmp
memory/2524-406-0x0000000000400000-0x00000000005AB000-memory.dmp
memory/2584-769-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2620-900-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2792-584-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2808-261-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2808-510-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2912-777-0x0000000000400000-0x00000000004E4000-memory.dmp
memory/2980-759-0x0000000000400000-0x0000000000671000-memory.dmp
memory/3112-803-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3116-606-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3124-758-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3252-908-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3328-0-0x00000000025A0000-0x00000000025A1000-memory.dmp
memory/3328-797-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3328-102-0x0000000000400000-0x0000000000738000-memory.dmp
memory/3480-925-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3624-222-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3636-498-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3648-798-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3720-757-0x0000000000400000-0x000000000041B000-memory.dmp
memory/3800-497-0x0000000000400000-0x0000000000671000-memory.dmp
memory/3852-736-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4008-893-0x0000000000400000-0x00000000004E4000-memory.dmp
memory/4036-747-0x0000000000400000-0x00000000004E4000-memory.dmp
memory/4204-804-0x0000000000400000-0x0000000000671000-memory.dmp
memory/4280-663-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4384-789-0x0000000000400000-0x00000000004E4000-memory.dmp
memory/4472-670-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4740-585-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4936-738-0x0000000000400000-0x000000000041B000-memory.dmp
memory/4952-808-0x0000000000400000-0x000000000041B000-memory.dmp
memory/5064-183-0x0000000000400000-0x0000000000671000-memory.dmp