Overview

overview

10

Static

static

6

AES-NI.exe

windows7-x64

7

AES-NI.exe

windows10-2004-x64

7

Abrechnung.exe

windows7-x64

8

Abrechnung.exe

windows10-2004-x64

8

Box (2).exe

windows7-x64

3

Box (2).exe

windows10-2004-x64

3

Box.exe

windows7-x64

3

Box.exe

windows10-2004-x64

3

a66dde2298...43.exe

windows7-x64

9

a66dde2298...43.exe

windows10-2004-x64

9

a7768f4973...e0.exe

windows7-x64

10

a7768f4973...e0.exe

windows10-2004-x64

10

aa7ff3bc28...1e.exe

windows7-x64

7

aa7ff3bc28...1e.exe

windows10-2004-x64

7

aace43af8d...99.exe

windows7-x64

8

aace43af8d...99.exe

windows10-2004-x64

8

ad3cc219a8...ws.dll

windows7-x64

10

ad3cc219a8...ws.dll

windows10-2004-x64

10

aee03626b8...b1.exe

windows7-x64

6

aee03626b8...b1.exe

windows10-2004-x64

6

afd3b729cf...2e.exe

windows7-x64

10

afd3b729cf...2e.exe

windows10-2004-x64

10

b56c4569d6...ss.exe

windows7-x64

3

b56c4569d6...ss.exe

windows10-2004-x64

3

0.84762379...67.exe

windows7-x64

7

0.84762379...67.exe

windows10-2004-x64

3

zsgblrbrum...ke.exe

windows7-x64

7

zsgblrbrum...ke.exe

windows10-2004-x64

3

b7d9f11c16...b0.exe

windows7-x64

5

b7d9f11c16...b0.exe

windows10-2004-x64

5

b8f60c64c7...af.exe

windows7-x64

10

b8f60c64c7...af.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/11/2024, 03:27

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
  • Size 164KB
  • Sample241122-dz7tmazlan
  • SHA256 afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
hydracryptdefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealer

Malware Config

Signatures

  • HydraCrypt

    Relatively unsophisticated ransomware family based on leaked CrypBoss source code.

    ransomwarehydracrypt
  • Hydracrypt family
    hydracrypt
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Renames multiple (904) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 3 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 64 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 45 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
    "C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1888
    • C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
      C:\Users\Admin\AppData\Local\Temp\afd3b729cf99fb9ea441f42862a4835d1d6eeb36ee535f9b206e3a00382c972e.exe
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Adds Run key to start application
      • Drops desktop.ini file(s)
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2880
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C net stop vss
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3952
        • C:\Windows\SysWOW64\net.exe
          net stop vss
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1076
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop vss
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1108
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4072
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C wmic shadowcopy delete
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2004
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic shadowcopy delete
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          PID:5068
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Z: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4524
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Y: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4448
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=X: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:232
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=W: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1324
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=V: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4592
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=U: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:904
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=T: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1536
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=S: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4808
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=R: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4636
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=Q: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4880
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=P: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2196
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=O: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4804
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=N: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2828
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=M: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3636
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=L: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4496
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=K: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:992
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=J: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1584
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=I: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1728
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=H: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1904
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=G: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1152
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=F: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3632
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=E: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3064
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=D: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4008
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=C: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3824
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=B: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3088
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C vssadmin Delete Shadows /For=A: /All
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2696
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2880 -s 1864
        3⤵
        • Program crash
        PID:2756
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:220
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2880 -ip 2880
    1⤵
      PID:540

    Network

          MITRE ATT&CK Enterprise v15

          Reconnaissance

          Resource Development

          Initial Access

          Execution

          Windows Management Instrumentation

          1
          T1047

          Persistence

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Privilege Escalation

          Boot or Logon Autostart Execution

          1
          T1547

          Registry Run Keys / Startup Folder

          1
          T1547.001

          Defense Evasion

          Indicator Removal

          1
          T1070

          File Deletion

          1
          T1070.004

          Modify Registry

          1
          T1112

          Credential Access

          Credentials from Password Stores

          1
          T1555

          Credentials from Web Browsers

          1
          T1555.003

          Unsecured Credentials

          1
          T1552

          Credentials In Files

          1
          T1552.001

          Discovery

          Peripheral Device Discovery

          1
          T1120

          Query Registry

          2
          T1012

          System Information Discovery

          3
          T1082

          System Location Discovery

          1
          T1614

          System Language Discovery

          1
          T1614.001

          Lateral Movement

          Collection

          Data from Local System

          1
          T1005

          Command and Control

          Exfiltration

          Impact

          Inhibit System Recovery

          1
          T1490

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          background.png.hydracrypttmp_ID_5d76c7f9
          • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.hydracrypttmp_ID_5d76c7f9
          • Size 126KB
          • SHA256 7d53218b8e9e636979d6de9806c00ebe4970945117d422b36211f682f23d1f9b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          overlay.png.hydracrypttmp_ID_5d76c7f9
          • Path C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.hydracrypttmp_ID_5d76c7f9
          • Size 28KB
          • SHA256 284259f63c228e599d2ef0e2dd398adbd04d7bafd21a9968b34f9e793132dd0b
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          resource.xml.hydracrypttmp_ID_5d76c7f9
          • Path C:\ProgramData\Microsoft\Device Stage\Task\{07deb856-fc6e-4fb9-8add-d8f2cf8722c9}\resource.xml.hydracrypttmp_ID_5d76c7f9
          • Size 1KB
          • SHA256 64633009c64e4e1993165f91c8ce3c81cc871481426e7de98dfb2844fb55b224
          • MD5 SHA1 SHA512
          Submit Download

          winword.exe_Rules.xml.hydracrypttmp_ID_5d76c7f9
          • Path C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\winword.exe_Rules.xml.hydracrypttmp_ID_5d76c7f9
          • Size 332KB
          • SHA256 6d409123587356493fe4038ae287b680c947365b0ebe15be9083f9027e583df3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          winword.exe.db.hydracrypttmp_ID_5d76c7f9
          • Path C:\Users\Admin\AppData\Local\Microsoft\Office\OTele\winword.exe.db.hydracrypttmp_ID_5d76c7f9
          • Size 24KB
          • SHA256 6baa96d33ae833f889408ad7b18056db668f6f9ca0c0d61eda2dcc1c19d84c72
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          desktop.ini.hydracrypttmp_ID_5d76c7f9
          • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn2\desktop.ini.hydracrypttmp_ID_5d76c7f9
          • Size 174B
          • SHA256 551e94a75cbe0f9d3add04cebbc75b3ef94bf9de2ef6d46c34ae3d5308535d87
          • MD5 SHA1 SHA512
          Submit Download

          settings.dat.hydracrypttmp_ID_5d76c7f9
          • Path C:\Users\Admin\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat.hydracrypttmp_ID_5d76c7f9
          • Size 8KB
          • SHA256 89d0bc5fab2dc4ee6cdbc144d7574f43691e2ce28976a0e4eb4a72f7bd56d268
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          settings.dat.hydracrypt_ID_5d76c7f9
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.hydracrypt_ID_5d76c7f9
          • Size 8KB
          • SHA256 e7c252b59d67a79ec43927e1d7459d906fa63f7cb80816b4808881a296fb7a23
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          0.1.filtertrie.intermediate.txt.hydracrypttmp_ID_5d76c7f9
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{68f64396-d409-40fb-b49c-188b7cbd08a4}\0.1.filtertrie.intermediate.txt.hydracrypttmp_ID_5d76c7f9
          • Size 5B
          • SHA256 2b411055e8f355a5aeda051a6191dc8da2525b67f6c52786f439c17fdfd315a5
          • MD5 SHA1 SHA512
          Submit Download

          0.2.filtertrie.intermediate.txt.hydracrypttmp_ID_5d76c7f9
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{68f64396-d409-40fb-b49c-188b7cbd08a4}\0.2.filtertrie.intermediate.txt.hydracrypttmp_ID_5d76c7f9
          • Size 5B
          • SHA256 b58d3b5c33fb174157b3cdb5eed3dbe7d4d8a93e86550f663c72b8eabeba5e36
          • MD5 SHA1 SHA512
          Submit Download

          AppCache133727656120098725.txt.hydracrypttmp_ID_5d76c7f9
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656120098725.txt.hydracrypttmp_ID_5d76c7f9
          • Size 77KB
          • SHA256 b852348092e0974aacfdf60d098c923991a0dc77f230b25bdb663cf330163246
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          AppCache133727656590293648.txt.hydracrypttmp_ID_5d76c7f9
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727656590293648.txt.hydracrypttmp_ID_5d76c7f9
          • Size 47KB
          • SHA256 4d6028b59a37806cba25769fe7ac38e2c69ae7934f190d948ae59ef06674ae6e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          AppCache133727663328721506.txt.hydracrypttmp_ID_5d76c7f9
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727663328721506.txt.hydracrypttmp_ID_5d76c7f9
          • Size 63KB
          • SHA256 d4145158b063977066854b576a6000bf424468add2cb138c87461f1380706d60
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          AppCache133727666039184869.txt.hydracrypttmp_ID_5d76c7f9
          • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133727666039184869.txt.hydracrypttmp_ID_5d76c7f9
          • Size 74KB
          • SHA256 f16af7166e80cc6352fb27194b0910082fa6d89afaff67bc25602b69f97c2377
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          Microsoft .NET Framework 4.7.2 Setup_20241007_091203424.html.hydracrypttmp_ID_5d76c7f9
          • Path C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20241007_091203424.html.hydracrypttmp_ID_5d76c7f9
          • Size 93KB
          • SHA256 cd3a7f06855cf7427c00cd74f48f2e540a74ad59d4812b59bb08199ffb1316ca
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          wct5658.tmp.hydracrypttmp_ID_5d76c7f9
          • Path C:\Users\Admin\AppData\Local\Temp\wct5658.tmp.hydracrypttmp_ID_5d76c7f9
          • Size 63KB
          • SHA256 d10faecb7f20c2462ae401656463fa551bccdd4cc81225e94af415a1d88c3597
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          1$FUWW$FFHEX.dat
          • Path C:\Users\Admin\AppData\Roaming\1$FUWW$FFHEX.dat
          • Size 1KB
          • SHA256 8edb37954f4e54cff87056df57bbb04f1e27058a4110742a7a9fbd2909493d15
          • MD5 SHA1 SHA512
          Submit Download

          Desktop.ini.hydracrypttmp_ID_5d76c7f9
          • Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini.hydracrypttmp_ID_5d76c7f9
          • Size 170B
          • SHA256 8e45e044052e8338de37e3c0888d8bc1f4cea43f9f04d8e8283bacaa7d96fd23
          • MD5 SHA1 SHA512
          Submit Download

          README_DECRYPT_HYDRA_ID_5d76c7f9.txt
          • Path C:\Users\Public\Videos\README_DECRYPT_HYDRA_ID_5d76c7f9.txt
          • Size 915B
          • SHA256 ebbd287de8f3e2f61ba1c41bec8545ad1c8544f865f4eb17b1e2059c8a7eb275
          • MD5 SHA1 SHA512
          Submit Download

          memory/1888-0-0x0000000002250000-0x0000000002255000-memory.dmp
          Download

          memory/2880-783-0x0000000000400000-0x0000000000978000-memory.dmp
          Download

          memory/2880-778-0x0000000000400000-0x000000000040E000-memory.dmp
          Download

          memory/2880-3789-0x0000000000400000-0x000000000040E000-memory.dmp
          Download

          memory/2880-3-0x0000000000400000-0x0000000000978000-memory.dmp
          Download

          memory/2880-1-0x0000000000400000-0x0000000000978000-memory.dmp
          Download

          memory/2880-2233-0x0000000000400000-0x000000000040E000-memory.dmp
          Download

          memory/2880-5319-0x0000000000400000-0x0000000000978000-memory.dmp
          Download

          memory/2880-5322-0x0000000000400000-0x000000000040E000-memory.dmp
          Download