Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/10/2026, 04:15
General
- Target jaffacakes118_Trojan-Ransom.Win32.SageCrypt.ddo.exe
- Size 344KB
- Sample261016-evn2dsff28
- SHA256 68598781fed72573be2a251f491debe461adafe669fe9989c7b9acdaf3164fc1
Score
10/10
Malware Config
Extracted
Path
-
C:\Users\Admin\Downloads\!HELP_SOS.hta
Ransom Note
- English Deutsch Italiano Français Español Norsk Português Nederlands 한국어 Bahasa Melayu 中文 Türkçe Tiếng Việt हिन्दी Basa Jawa فارسی العربية The file is encrypted but can be restored Die Datei ist verschlüsselt, aber kann wiederhergestellt werden Il file è crittografato, ma può essere ripristinato Le fichier est crypté mais peut être restauré El archivo está encriptado pero puede ser restaurado Filen er kryptert men kan bli gjenopprettet O arquivo está criptografado, mas poderá ser descriptografado Het bestand is versleuteld maar kan worden hersteld 파일은 암호화되었지만 복원 할 수 있습니다 Fail ini dienkripsikan tetapi boleh dipulih semula. 文件已被加密，但是可以解密 Dosya şifrelenmiş ancak geri yüklenebilir. Tập tin bị mã hóa nhưng có thể được khôi phục फाइल एनक्रिप्टड हैं लेकिन रिस्टोर की जा सकती हैं File ini dienkripsi tetapi dapat dikembalikan این فایل رمزگذاری شده است اما می تواند بازیابی شود الملف مشفر لكن من الممكن إسترجاعه The file you tried to open and other important files on your computer were encrypted by "SAGE 2.2 Ransomware". Die Datei, die Sie öffnen wollten, und andere wichtige Dateien auf ihrem Computer wurden von "SAGE 2.2 Ransomware" verschlüsselt. Il file che hai tentato di aprire e altri file importanti del tuo computer sono stati crittografati da "SAGE 2.2 Ransomware". Le fichier que vous essayez d’ouvrir et d’autres fichiers importants sur votre ordinateur ont été cryptés par "SAGE 2.2 Ransomware". El archivo que intentó abrir y otros importantes archivos en su computadora fueron encriptados por "SAGE 2.2 Ransomware". Filen du prøvde åpne og andre viktige filer på datamaskinen din ble kryptert av "SAGE 2.2 Ransomware". O arquivo que você está tentando acessar está criptografado, outros arquivos importantes em seu computador também foram criptografados por "SAGE 2.2 Ransomware". Het bestand dat je probeert te openen en andere belangrijke bestanden op je computer zijn beveiliged door "SAGE 2.2 Ransomware". 컴퓨터에서 여는 파일 및 기타 중요한 파일은 "SAGE 2.2 Ransomware"에 의해 암호화되었습니다. Fail yang anda cuba buka dan fail penting yang lain di komputer anda telah dienkripskan oleh "SAGE 2.2 Ransomware". 您试图打开的文件以及您计算机上的其它文件已经用"SAGE 2.2 Ransomware"进行了加密。 Açmaya çalıştığınız dosya ve diğer önemli dosyalarınızı bilgisayarınızda "SAGE 2.2 Ransomware" tarafından şifrelenmiş. Tập tin mà bạn cố mở và những tập tin quan trọng khác trên máy tính của bạn bị mã hóa bởi "SAGE 2.2 Ransomware". वो फाइल जिसे आपने खोलने की कोशिश की और आपके कंप्यूटर पर बाकी महत्वपूर्ण फाइले हमारी ओर से इंक्रिप्टिड की गई हैं "SAGE 2.2 Ransomware"। File yang Anda coba untuk buka dan file penting lain di komputer Anda yang dienkripsi oleh "SAGE 2.2 Ransomware". فایلی که شما تلاش کردید بازکنید و فایل های کامپیوتر شما رمزگذاری شده است "SAGE 2.2 Ransomware". الملف الذي كنت بصدد فتحه وبعض الملفات المهمة على حاسوبك تم تشفيرها "SAGE 2.2 Ransomware". Action required to restore your files. Aktion erforderlich, um ihre Daten wiederherzustellen. Azione necessaria per ripristinare i file. Action requise pour restaurer vos fichiers. Se requiere una acción para restaurar sus archivos. Handling er nødvendig for å gjenopprette filene dine. O que você deve fazer para restaurar seus arquivos. Aktie vereist om je bestanden te herstellen. 파일을 복원하는 데 필요한 작업. Tindakan diperlukan untuk memulih fail anda. 要恢复文件需要进行解密。 Dosyalarınızı geri yüklemek için harekete geçin. Cần phải hành động để khôi phục các tập tin. आपकी फाइलों को रिस्टोर करने के लिए कार्रवाई की जरूरत हैं। Tindakan diperlukan untuk mengembalikan file Anda. برای بازگرداندن فایل های خود را اقدام کنید. الإجراءات المطلوبة لاستعادة الملفات الخاصة بك. File recovery instructions You probably noticed that you can not open your files and that some software stopped working correctly. This is expected. Your files content is still there, but it was encrypted by "SAGE 2.2 Ransomware" . Your files are not lost, it is possible to revert them back to normal state by decrypting. The only way you can do that is by getting "SAGE Decrypter" software and your personal decryption key. Using any other software which claims to be able to restore your files will result in files being damaged or destroyed. You can purchase "SAGE Decrypter" software and your decryption key at your personal page you can access by following links: http://7gie6ffnkrjykggd.we0sgd.com/ http://7gie6ffnkrjykggd.y8lkjg5.net/ If none of these links work for you, click here to update the list. Updating links... Something went wrong while updating links, please wait some time and try again or use "Tor Browser" method below. Links updated, if new ones still don't work, please wait some time and try again or use "Tor Browser" method below. If you are asked for your personal key, copy it to the form on the site. This is your personal key: AVKZPYRZgjzTOXIJyU076hxzXamc3g9j4Er_qLkPV26HsAHf488zKRPA You will also be able to decrypt one file for free to make sure "SAGE Decrypter" software is able to recover your files If none of those links work for you for a prolonged period of time or you need your files recovered as fast as possible, you can also access your personal page using "Tor Browser". In order to do that you need to: open Internet Explorer or any other internet browser; copy the address https://www.torproject.org/download/download-easy.html.en into address bar and press "Enter"; once the page opens, you will be offered to download Tor Browser, download it and run the installator, follow installation instructions; once installation is finished, open the newly installed Tor Browser and press the "Connect" button (button can be named differently if you installed non-English version); Tor Browser will establish connection and open a normal browser window; copy the address http://7gie6ffnkrjykggd.onion/login/AVKZPYRZgjzTOXIJyU076hxzXamc3g9j4Er_qLkPV26HsAHf488zKRPA into this browser address bar and press "Enter"; your personal page should be opened now; if it didn't then wait for a bit and try again. If you can not perform this steps then check your internet connection and try again. If it still doesn't work, try asking some computer guy for help in performing this steps for you or look for some video guides on YouTube. You can find a copy of this instruction in files named "!HELP_SOS" stored next to your encrypted files. Anleitung zur Dateiwiederherstellung Sie haben sicherlich gemerkt, dass Sie Ihre Daten nicht öffnen können und dass Programme nicht mehr ordnungsgemäß funktionieren. Dies ist zu erwarten. Die Dateiinhalte existieren noch, aber wurden mit {us_enc}} verschlüsselt. Ihre Daten sind nicht verloren. Es ist möglich, sie mit Hilfe von Entschlüsselung in ihren Originalzustand zurückzuversetzen. Die einzige Möglichkeit das zu tun, ist die Verwendung von "SAGE Decrypter" Software und Ihr persönlicher Entschlüsselungskey. Das Verwenden von anderer Software, die angeblich ihre Daten wiederherstellen kann, wird dazu führen, dass Ihre Daten beschädigt oder zerstört werden. Sie können die "SAGE Decrypter" Software und Ihren Entschlüsselungskey auf Ihrer persönlichen Seite erwerben, indem Sie diesen Links folgen: http://7gie6ffnkrjykggd.we0sgd.com/ http://7gie6ffnkrjykggd.y8lkjg5.net/ If none of these links work for you, click here to update the list. Updating links... Something went wrong while updating links, please wait some time and try again or use "Tor Browser" method below. Links updated, if new ones still don't work, please wait some time and try again or use "Tor Browser" method below. Falls Sie nach ihrem persönlichen Key gefragt werden, kopieren Sie ihn in das Formular auf dieser Seite. Dies ist Ihr persönlicher Key: AVKZPYRZgjzTOXIJyU076hxzXamc3g9j4Er_qLkPV26HsAHf488zKRPA Sie können eine Datei gratis entschlüssen, um sicher zu sein, dass die "SAGE Decrypter" Software ihre Daten wiederherstellen kann Falls keine dieser Links über einen längeren Zeitraum funktionieren sollten oder Sie Ihre Daten so schnell wie möglich wiederherstellen müssen, können Sie Ihre persönliche Seite mit Hilfe des "Tor Browser" aufrufen. Dazu benötigen Sie: Öffnen Sie den Internet Explorer oder einen anderen Internetbrowser; Kopieren Sie diese Adresse https://www.torproject.org/download/download-easy.html.en in die Adressleiste und drücken Sie "Enter"; So bald sich die Seite öffnet, wird Ihnen der Download des Tor Browser angeboten. Laden Sie ihn herunter und führen Sie die Installation aus, indem Sie den Installationsanweisungen folgen; Wenn die Installation abgeschlossen ist, öffnen Sie den soeben installierten Tor Browser und drücken Sie den "Connect" Knopf (Der Namen kann abweichen, falls Sie eine nicht-englische Version installiert haben); Tor Browser wird eine Verbindung herstellen und ein normales Browserfenster öffnen; Kopieren Sie die Adresse http://7gie6ffnkrjykggd.onion/login/AVKZPYRZgjzTOXIJyU076hxzXamc3g9j4Er_qLkPV26HsAHf488zKRPA in die Browseradressleiste und drücken Sie "Enter"; Ihre persönliche Seite sollte sich nun geöffnet haben; falls nicht: Warten Sie eine Weile und versuchen Sie es erneut. Falls Sie nicht in der Lage sind, diese Schritte durchzuführen, überprüfen Sie Ihre Internetverbindung. Wenn es noch immer nicht funktioniert, fragen Sie jemanden, der sich mit Computern auskennt, um diese Schritte durchzuführen oder schauen Sie sich einige Videoanleitungen auf YouTube an. Sie finden eine Kopie dieser Anleitung in einer Datei namens "!HELP_SOS" neben Ihren verschlüsselten Daten. Istruzioni per il recupero dei file Probabilmente hai notato che non puoi più aprire i tuoi file e alcuni software hanno smesso di funzionare correttamente. Questo era previsto. I tuoi file si trovano ancora al loro posto, ma sono stati crittografati da "SAGE 2.2 Ransomware" . I tuoi file non sono persi, è possibile farli tornare al loro stato normale eseguendo una decrittazione. L'unico modo in cui è possibile farlo è scaricare il software "SAGE Decrypter" e la tua chiave personale di decrittazione. Utilizzando un qualsiasi altro software che sostiene di essere in grado di ripristinare i tuoi file, li danneggerà o distruggerà per sempre. È possibile acquistare il software "SAGE Decrypter" e la tua chiave di decrittazione nella tua pagina personale a cui puoi accedere dai seguenti collegamenti: http://7gie6ffnkrjykggd.we0sgd.com/ http://7gie6ffnkrjykggd.y8lkjg5.net/ If none of these links work for you, click here to update the list. Updating links... Something went wrong while updating links, please wait some time and try again or use "Tor Browser" method below. Links updated, if new ones still don't work, please wait some time and try again or use "Tor Browser" method below. Se viene richiesta la chiave personale, è possibile copiarla dal modulo del sito. Questa è la chiave personale: AVKZPYRZgjzTOXIJyU076hxzXamc3g9j4Er_qLkPV26HsAHf488zKRPA Sarà anche possibile decriptare un file gratuitamente per assicurarsi che il software "SAGE Decrypter" sia in grado di recuperare i file Se nessuno dei collegamenti funziona per un periodo di tempo prolungato o è necessario ripristinare il prima possibile, è possibile accedere alla propria pagina personale anche utilizzando "Tor Browser". Per poterlo fare è necessario: aprire Internet Explorer o qualsiasi altro browser internet; copiare l'indirizzo https://www.torproject.org/download/download-easy.html.en nella barra degli indirizzi e premere "Enter"; una volta aperta la pagina, verrà offerta la possibilità di scaricare Tor Browser, scarica ed esegui il file seguendo le istruzioni di installazione; una volta completata l'installazione, aprire il nuovo Tor Browser e premere il pulsante "Connect" (il pulsante potrebbe avere un nome diverso se non si è installata la versione inglese); Tor Browser stabilirà una connessione e aprirà una normale finestra di navigazione; copiare l'indirizzo http://7gie6ffnkrjykggd.onion/login/AVKZPYRZgjzTOXIJyU076hxzXamc3g9j4Er_qLkPV26HsAHf488zKRPA nella barra degli indirizzi del browser e premere "Enter"; ora dovrebbe essere possibile aprire la pagina personale; se così non fosse, attendere qualche istante e riprovare. Se non è possibile eseguire questo passaggio, controllare la connessione internet e riprovare. Se ancora non funziona, prova a chiedere se qualche esperto di computer può farlo al posto tuo oppure dai un'occhiata a qualche video guida su YouTube. Puoi trovare una copia di queste istruzioni nel file di nome "!HELP_SOS" conservato con i tuoi file criptati. Les instructions pour restaurer le fichier Vous avez sûrement remarqué que vous ne pouvez pas ouvrir vos fichiers et qu’un logiciel a arrêté de fonctionner correctement. C’est attendu. Le contenu de vos fichiers est encore disponible, mais il a été crypté par "SAGE 2.2 Ransomware" . Vos fichiers ne sont pas perdus, c’est possible de les récupérer et les avoir à l’état normal en les décryptant. La seule façon de le faire et en ayant le logiciel "SAGE Decrypter" et votre clé de décryptage. En utilisant un autre logiciel qui prétend pouvoir restaurer vos fichiers va endommager et détruir vos fichiers. Vous pouvez acheter le logiciel "SAGE Decrypter" et votre clé de décryptage sur votre profile auquel vous pouvez accéder en cliquant sur ce lien: http://7gie6ffnkrjykggd.we0sgd.com/ http://7gie6ffnkrjykggd.y8lkjg5.net/ If none of these links work for you, click here to update the list. Updating links... Something went wrong while updating links, please wait some time and try again or use "Tor Browser" method below. Links updated, if new ones still don't work, please wait some time and try again or use "Tor Browser" method below. Si vous êtes demandé de fournir votre clé, copiez la dans le formulaire du site. Voici votre clé personnelle: AVKZPYRZgjzTOXIJyU076hxzXamc3g9j4Er_qLkPV26HsAHf488zKRPA Vous serez en mesure de décrypter un fichier gratuitement pour être sûre que le logiciel "SAGE Decrypter" est capable de restaurer vos fichiers Si aucun des liens ne marche pour vous pour une période prolongée ou si vous avez besoin de restaurer vos fichiers rapidement, vous pouvez accéder à votre profile en utilisant "Navigateut Tor". Pour le faire vous devez: Ouvrez Explorer ou n’importe quel autre navigateut; Copiez cette addresse https://www.torproject.org/download/download-easy.html.en dans la barre d’adresse et cliquez sur "Enterer"; Une fois que la page est ouverte, on va vous proposer de télécharger le navigateur Tor, Téléchargez-le et lancez l’installation, suivez les instructions d’installation ; Une fois l’installation faite, ouvrez votre nouveau navigateur Tor et appuyez sur le bouton "Connect" (Le bouton peut être nommé différemment si vous n’avez pas installé la version en anglais); Le navigateur Tor va établir une connection et ouvrir une fenêtre ordinaire de navigateur ; copiez l’adresse http://7gie6ffnkrjykggd.onion/login/AVKZPYRZgjzTOXIJyU076hxzXamc3g9j4Er_qLkPV26HsAHf488zKRPA dans la barre d’adresse et cliquez sur "Entrer"; Votre profile doit être ouvert maintenant; si ça ne marche pas attendez puis essayez encore une fois. Si vous n’arrivez pas à suivre ces étapes verifies alors votre connexion internet et réessayez. Si ça ne marche toujours pas, essayez de demander à un informaticien pour suivre ces étapes pour vous ou regardez des vidéos d’instruction sur YouTube. Vous pouvez trouver une copie de ces
URLs
-
http://7gie6ffnkrjykggd.we0sgd.com/
-
http://7gie6ffnkrjykggd.y8lkjg5.net/
-
http://7gie6ffnkrjykggd.onion/login/AVKZPYRZgjzTOXIJyU076hxzXamc3g9j4Er_qLkPV26HsAHf488zKRPA
-
http://7gie6ffnkrjykggd.onion/login/AVKZPYRZgjzTOXIJyU076hxzXamc3g9j4Er_qLkPV26HsAHf488zKRPA到浏览器的地址栏，然后按下"回车"键；
-
http://'+s.bp
-
http://'+s.bp+s.txp+tx
Signatures
- Family: Sage
Sage is a ransomware that has been active since 2020.
- Contacts a large (7700) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
- Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
- Deletes itself 1 TTPs 1 IoCs
- Executes dropped EXE 4 IoCs
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
- Sets desktop wallpaper using registry 2 TTPs 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Control Panel 1 IoCs
- Modifies data under HKEY_USERS 3 IoCs
- Modifies registry class 17 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.ddo.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.ddo.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.ddo.exe"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Ransom.Win32.SageCrypt.ddo.exe" g2⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /CREATE /TN "N0mFUQoa" /TR "C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" /SC ONLOGON /RL HIGHEST /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"2⤵
- Executes dropped EXE
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\!HELP_SOS.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}3⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f1.vbs"3⤵
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\f252888.vbs"2⤵
- Deletes itself
- Executes a VBScript file via the Windows Script Host.
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exeC:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe"C:\Users\Admin\AppData\Roaming\Rj3fNWF3.exe" g2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004DC 0x00000000000004E01⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Visual Basic
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
f1.vbs
f252888.vbs
Rj3fNWF3.exe
s1qoaKDO.tmp
!HELP_SOS.hta
ImportCopy.raw...
MergeOptimize.fon...
memory/1976-37-0x0000000000400000-0x0000000000458000-memory.dmp
memory/1976-327-0x0000000000400000-0x0000000000458000-memory.dmp
memory/1976-24-0x0000000000400000-0x0000000000458000-memory.dmp
memory/1976-350-0x0000000000400000-0x0000000000458000-memory.dmp
memory/2412-17-0x0000000000400000-0x0000000000458000-memory.dmp
memory/2412-19-0x0000000000400000-0x0000000000458000-memory.dmp
memory/2412-16-0x0000000003550000-0x00000000035C7000-memory.dmp
memory/2760-20-0x0000000000400000-0x0000000000458000-memory.dmp
memory/2760-21-0x0000000000400000-0x0000000000458000-memory.dmp
memory/2780-36-0x0000000000400000-0x0000000000458000-memory.dmp
memory/2780-38-0x0000000000400000-0x0000000000458000-memory.dmp
memory/5020-11-0x0000000003550000-0x00000000035C7000-memory.dmp
memory/5020-12-0x0000000003500000-0x0000000003501000-memory.dmp
memory/5020-13-0x0000000000400000-0x0000000000458000-memory.dmp
memory/5020-9-0x0000000003550000-0x00000000035C7000-memory.dmp
memory/5020-35-0x0000000000400000-0x0000000000458000-memory.dmp
memory/5876-0-0x0000000003620000-0x0000000003697000-memory.dmp
memory/5876-34-0x0000000000400000-0x0000000000458000-memory.dmp
memory/5876-10-0x0000000003500000-0x0000000003501000-memory.dmp
memory/5876-6-0x0000000000400000-0x0000000000458000-memory.dmp
memory/5876-5-0x0000000003500000-0x0000000003501000-memory.dmp
memory/5876-4-0x0000000003620000-0x0000000003697000-memory.dmp
memory/5876-3-0x0000000003500000-0x0000000003501000-memory.dmp
memory/5876-2-0x0000000003500000-0x0000000003501000-memory.dmp
memory/5876-1-0x0000000003500000-0x0000000003501000-memory.dmp