Resubmissions

17/08/2026, 05:17

260817-fy7tcatzav

17/08/2026, 04:48

260817-fffl5stcnc

17/08/2026, 04:42

260817-fb7j3ael618

17/08/2026, 04:39

260817-e9yt5stbma5

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-en
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
  • submitted
    17/08/2026, 04:39

General

  • Target
    Capitalism_Lab_ENG_to_PT-master/source/Release/font/Notice.html
  • Size 10KB
  • Sample260817-e9yt5stbma
  • SHA256 a76f423ec0493a856dacaf2daf470c9021def5416b2beba3560b5a043d1df08e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 10 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 7 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Capitalism_Lab_ENG_to_PT-master\source\Release\font\Notice.html
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1220
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffa61bcc188,0x7ffa61bcc194,0x7ffa61bcc1a0
      2⤵
        PID:3872
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,5354467105658281366,7581008085084696932,524288 --field-trial-handle=2456,i,5024793900750034517,2135140626059260788,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:3
        2⤵
        • System Time Discovery
        PID:4060
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,4280980735857508135,14876028482928196527,524288 --field-trial-handle=2456,i,5024793900750034517,2135140626059260788,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
        2⤵
          PID:932
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,10130901747640882662,17445437252224888925,262144 --field-trial-handle=2456,i,5024793900750034517,2135140626059260788,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:2
          2⤵
            PID:3440
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3396,i,14156251474333243115,2344021593490608256,2097152 --field-trial-handle=2456,i,5024793900750034517,2135140626059260788,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
            2⤵
              PID:4056
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,8356473426961842854,16746076813820437420,2097152 --field-trial-handle=2456,i,5024793900750034517,2135140626059260788,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
              2⤵
                PID:3588
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,1490002849419445785,16155942232491014123,2097152 --field-trial-handle=2456,i,5024793900750034517,2135140626059260788,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
                2⤵
                  PID:468
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,10074632381739042645,11803892778179094625,2097152 --field-trial-handle=2456,i,5024793900750034517,2135140626059260788,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:2
                  2⤵
                    PID:2120
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,568083582769427738,13023478743181820608,524288 --field-trial-handle=2456,i,5024793900750034517,2135140626059260788,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
                    2⤵
                      PID:2876
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,387310750273241406,12498915681291644505,524288 --field-trial-handle=2456,i,5024793900750034517,2135140626059260788,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
                      2⤵
                        PID:2184
                      • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,3283247954309384839,9903572603257727774,524288 --field-trial-handle=2456,i,5024793900750034517,2135140626059260788,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
                        2⤵
                          PID:3616
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,3283247954309384839,9903572603257727774,524288 --field-trial-handle=2456,i,5024793900750034517,2135140626059260788,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
                          2⤵
                            PID:3840
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                          1⤵
                            PID:4468
                          • C:\Windows\system32\taskmgr.exe
                            "C:\Windows\system32\taskmgr.exe" /4
                            1⤵
                            • Checks SCSI registry key(s)
                            • Checks processor information in registry
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            • Suspicious use of SendNotifyMessage
                            PID:4360
                          • C:\Windows\system32\mspaint.exe
                            "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\WatchClose.jpg"
                            1⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of SetWindowsHookEx
                            PID:3520
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
                            1⤵
                              PID:2800
                            • C:\Windows\system32\taskmgr.exe
                              "C:\Windows\system32\taskmgr.exe" /4
                              1⤵
                              • Checks SCSI registry key(s)
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious behavior: GetForegroundWindowSpam
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2292
                            • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                              "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                              1⤵
                              • Drops file in System32 directory
                              • Modifies data under HKEY_USERS
                              • Suspicious use of SetWindowsHookEx
                              PID:1948
                            • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
                              "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
                              1⤵
                              • Drops file in System32 directory
                              • Checks processor information in registry
                              • Enumerates system info in registry
                              • Modifies data under HKEY_USERS
                              • Suspicious use of SetWindowsHookEx
                              PID:2336

                            Network

                                  MITRE ATT&CK Enterprise v16

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                                  • Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx
                                  • Size 64KB
                                  • SHA256 b09f68b61d9ff5a7c7c8b10eee9447d4813ee0e866346e629e788cd4adecb66a
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                                  • Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock
                                  • Size 4B
                                  • SHA256 7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba
                                  • MD5 SHA1 SHA512

                                  F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                                  • Path C:\Users\Admin\AppData\Local\D3DSCache\e8010882af4f153f\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val
                                  • Size 944B
                                  • SHA256 878947d0ec814fe7c343cdebc05eebf00eb14f3023bdb3809a559e17f399fe5d
                                  • MD5 SHA1 SHA512 TLSH

                                  settings.dat

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                  • Size 280B
                                  • SHA256 4f5ef139065355dda6e570b51cc73f6355215f0abe5a572f0d0792323c6fbdcb
                                  • MD5 SHA1 SHA512 TLSH

                                  settings.dat

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                  • Size 280B
                                  • SHA256 4f09b67f3cd537e58118f5452ece8461e4fe6705ee65ee2a25a297c3b63b0bb2
                                  • MD5 SHA1 SHA512 TLSH

                                  settings.dat

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                  • Size 280B
                                  • SHA256 654b978d729690cf5286e1dd5d9be9a9bc9da2c14c910bec9ccd68a891484e7a
                                  • MD5 SHA1 SHA512 TLSH

                                  the-real-index

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                  • Size 3KB
                                  • SHA256 c64dff6c20ffa1e20e0a399e50a5b7c910dc92d0ca56b109f1b1152e7dbd7306
                                  • MD5 SHA1 SHA512 TLSH

                                  the-real-index~RFe58506d.TMP

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58506d.TMP
                                  • Size 3KB
                                  • SHA256 e757d11bf17ae043927acfc2077b93d2b43ee84794187f06a0c244a2ab982123
                                  • MD5 SHA1 SHA512 TLSH

                                  SiteList-Enterprise.json

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                  • Size 2B
                                  • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                  • MD5 SHA1 SHA512

                                  Edge Profile.ico

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                  • Size 70KB
                                  • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  Network Persistent State

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                  • Size 949B
                                  • SHA256 b6989c0d5a4389616e52ab7474d2cacdd4f880494f6fb0396b8aa9adc204536c
                                  • MD5 SHA1 SHA512 TLSH

                                  Network Persistent State

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                  • Size 111B
                                  • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                  • MD5 SHA1 SHA512 TLSH

                                  SCT Auditing Pending Reports

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                  • Size 2B
                                  • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                  • MD5 SHA1 SHA512

                                  Preferences

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                  • Size 12KB
                                  • SHA256 ea17bbcbf978f758c3e2872f65734f21469a0b69c1ae8f7f0f85b4a5db70563d
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  Preferences

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                  • Size 13KB
                                  • SHA256 b76e53c40676afd40c54fc28cd437fc1d7a50cbea34c8a90c99d11acf8bb7182
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  Secure Preferences

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                  • Size 30KB
                                  • SHA256 8fa7d80aa037a33d96136cfacf0da1df234bddc685865fad37b8a53e3a083fbb
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  sync_diagnostic.log

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                  • Size 4KB
                                  • SHA256 14d6fff5c7ea7e35ef92d23e793a12d252ecf57650e6fa803f060af80b932f9b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  Local State

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                  • Size 21KB
                                  • SHA256 346024f4fbdf5c1c35171195a7f58a50235a981eee15653b304170ea875b730b
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  Local State

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                  • Size 16KB
                                  • SHA256 c352d61ee2f8c374ba59733df38a060c59261b20f576f42d75f87fde6250b346
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  Local State

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                  • Size 8KB
                                  • SHA256 9a15cf02d305720c8a7cd616cce0de12959e8ce1447687d9d8d3c7f7f194bcbc
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  Local State

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                  • Size 8KB
                                  • SHA256 6972c760839a08491ca2ad9e616edc47918fa52dab807db235853e4e4382bf23
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  data_1

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
                                  • Size 264KB
                                  • SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
                                  • MD5 SHA1 SHA512 SSDEEP

                                  5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

                                  • Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
                                  • Size 2KB
                                  • SHA256 4ab7c87f48b3604383c9ecea9c5e04cf8a8f843844f562eee62f6d71c24ed2b8
                                  • MD5 SHA1 SHA512 TLSH

                                  officeclicktorun.exe.db-wal

                                  • Path C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db-wal
                                  • Size 12KB
                                  • SHA256 19523d5d40bd02e6e392ce2020ab593e1b8a9c25b07d84673e367495538acce9
                                  • MD5 SHA1 SHA512 SSDEEP TLSH

                                  memory/2292-303-0x000001A9DF730000-0x000001A9DF731000-memory.dmp

                                  memory/2292-305-0x000001A9DF730000-0x000001A9DF731000-memory.dmp

                                  memory/2292-306-0x000001A9DF730000-0x000001A9DF731000-memory.dmp

                                  memory/2292-307-0x000001A9DF730000-0x000001A9DF731000-memory.dmp

                                  memory/2292-296-0x000001A9DF730000-0x000001A9DF731000-memory.dmp

                                  memory/2292-295-0x000001A9DF730000-0x000001A9DF731000-memory.dmp

                                  memory/2292-297-0x000001A9DF730000-0x000001A9DF731000-memory.dmp

                                  memory/2292-304-0x000001A9DF730000-0x000001A9DF731000-memory.dmp

                                  memory/2292-302-0x000001A9DF730000-0x000001A9DF731000-memory.dmp

                                  memory/4360-281-0x000001C35E2E0000-0x000001C35E2E1000-memory.dmp

                                  memory/4360-293-0x000001C35E2E0000-0x000001C35E2E1000-memory.dmp

                                  memory/4360-292-0x000001C35E2E0000-0x000001C35E2E1000-memory.dmp

                                  memory/4360-291-0x000001C35E2E0000-0x000001C35E2E1000-memory.dmp

                                  memory/4360-287-0x000001C35E2E0000-0x000001C35E2E1000-memory.dmp

                                  memory/4360-288-0x000001C35E2E0000-0x000001C35E2E1000-memory.dmp

                                  memory/4360-289-0x000001C35E2E0000-0x000001C35E2E1000-memory.dmp

                                  memory/4360-290-0x000001C35E2E0000-0x000001C35E2E1000-memory.dmp

                                  memory/4360-283-0x000001C35E2E0000-0x000001C35E2E1000-memory.dmp

                                  memory/4360-282-0x000001C35E2E0000-0x000001C35E2E1000-memory.dmp