Analysis
- max time kernel
112s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
30/08/2026, 13:51
General
- Target 2026-08-30_a893395c0861e091bb1c4bd7bed093a9_cobalt-strike_elex_glassworm_icedid_vidar.exe
- Size 460KB
- Sample260830-q527jswwbx
- SHA256 6db3404901ebf572f0bd78cb99199ebeab8b52f1831fed46d35b41991f3b2950
Malware Config
Extracted
-
masonrat
-
c2.freemasonry.dev:38688
-
account_id
79657cb2ba113db51e34356dfeeb72a5
Signatures
- Family: masonrat
MasonRAT is a Windows RAT written in C.
- Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 3 IoCs
- Executes dropped EXE 2 IoCs
- Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks system information in the registry 2 TTPs 2 IoCs
System information is often read in order to detect sandboxing environments.
- Drops file in System32 directory 15 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Modifies data under HKEY_USERS 54 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 64 IoCs
- Suspicious use of AdjustPrivilegeToken 23 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 756 -s 9282⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-38f25471-3ba9-4330-bf30-3d49f959728b -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-238016e4-c1f7-4252-a9cc-d14bd97798e7 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-fe250f0f-8874-4a3a-8c4a-50f40373f997 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5246c021-08c0-4b5e-aa9d-3941c2764b54 -LifetimeId:3d73e08d-5796-4511-b9a0-6a0775cc61c2 -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2026-08-30_a893395c0861e091bb1c4bd7bed093a9_cobalt-strike_elex_glassworm_icedid_vidar.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-30_a893395c0861e091bb1c4bd7bed093a9_cobalt-strike_elex_glassworm_icedid_vidar.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1xmek5s3.0az.exe"C:\Users\Admin\AppData\Local\Temp\1xmek5s3.0az.exe"5⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Mason2026-08-30_a893395c0861e091bb1c4bd7bed093a9_cobalt-strike_elex_glassworm_icedid_vidar.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-08-30_a893395c0861e091bb1c4bd7bed093a9_cobalt-strike_elex_glassworm_icedid_vidar.exe'" /sc onlogon /rl HIGHEST5⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Mason2026-08-30_a893395c0861e091bb1c4bd7bed093a9_cobalt-strike_elex_glassworm_icedid_vidar.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-08-30_a893395c0861e091bb1c4bd7bed093a9_cobalt-strike_elex_glassworm_icedid_vidar.exe'" /sc onlogon /rl HIGHEST5⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\3x2q0nj1.1yt.exe"C:\Users\Admin\AppData\Local\Temp\3x2q0nj1.1yt.exe"5⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks system information in the registry
-
C:\Windows\SYSTEM32\schtasks.exeschtasks.exe /create /f /sc minute /mo 1 /tn "3x2q0nj1.1yt" /tr "C:\Users\Admin\AppData\Roaming\3x2q0nj1.1yt.exe"6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService1⤵
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;2⤵
-
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Drops file in System32 directory
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 548 -p 756 -ip 7562⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k CameraMonitor1⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000001a4 000000d81⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000228 000000d81⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000003e8 000000d81⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000394 000000d81⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000003ac 000000d81⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000003fc 000000d81⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000310 000000d81⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000278 000000d81⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000188 000000d81⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 00000144 000000d81⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000002f0 000000d81⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000003b8 000000d81⤵
-
C:\Windows\System32\smss.exe\SystemRoot\System32\smss.exe 000003a8 000000d81⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
WER.1d4a0b3e-a332-499c-b39a-b49b84a7016a.tmp.txt
WER.266b14cd-4d29-40fe-aec2-0989a8f44ad5.tmp.csv
WER.28b2d7c4-2adc-4d7d-80f2-313114ba9d37.tmp.csv
WER.dc329759-b6e3-415c-bd26-bc4d26e6fb8d.tmp.txt
1xmek5s3.0az.exe
3x2q0nj1.1yt.exe
olpa12s0.4hp.exe
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
memory/756-22-0x000001F6CEEF0000-0x000001F6CEF1B000-memory.dmp
memory/756-19-0x000001F6CEEC0000-0x000001F6CEEE5000-memory.dmp
memory/756-314-0x000001F6CEEF0000-0x000001F6CEF1B000-memory.dmp
memory/992-24-0x000002155EBA0000-0x000002155EBCB000-memory.dmp
memory/992-25-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/992-315-0x000002155EBA0000-0x000002155EBCB000-memory.dmp
memory/1000-439-0x00000224B87B0000-0x00000224B87DB000-memory.dmp
memory/1000-28-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/1000-27-0x00000224B87B0000-0x00000224B87DB000-memory.dmp
memory/1000-316-0x00000224B87B0000-0x00000224B87DB000-memory.dmp
memory/1008-108-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/1008-107-0x0000018FEF2D0000-0x0000018FEF2FB000-memory.dmp
memory/1040-109-0x0000025BD6CC0000-0x0000025BD6CEB000-memory.dmp
memory/1040-111-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/1120-114-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/1120-113-0x00000295E2C60000-0x00000295E2C8B000-memory.dmp
memory/1192-35-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/1192-34-0x000001E4B0140000-0x000001E4B016B000-memory.dmp
memory/1192-317-0x000001E4B0140000-0x000001E4B016B000-memory.dmp
memory/1248-117-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/1248-116-0x000001F4448A0000-0x000001F4448CB000-memory.dmp
memory/1320-120-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/1320-119-0x0000017C96F20000-0x0000017C96F4B000-memory.dmp
memory/1332-123-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/1332-122-0x000001DF27DF0000-0x000001DF27E1B000-memory.dmp
memory/1360-126-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/1360-125-0x0000026CA8D10000-0x0000026CA8D3B000-memory.dmp
memory/1552-318-0x000001EAF1580000-0x000001EAF15AB000-memory.dmp
memory/1552-43-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/1552-440-0x000001EAF1580000-0x000001EAF15AB000-memory.dmp
memory/1552-42-0x000001EAF1580000-0x000001EAF15AB000-memory.dmp
memory/1568-129-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/1568-128-0x000002155F220000-0x000002155F24B000-memory.dmp
memory/1632-131-0x0000014F2C970000-0x0000014F2C99B000-memory.dmp
memory/1632-132-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/1672-146-0x000001562EC50000-0x000001562EC7B000-memory.dmp
memory/1672-147-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/1712-135-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/1712-134-0x000002BD7B5F0000-0x000002BD7B61B000-memory.dmp
memory/1720-138-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/1720-137-0x00000203D5E30000-0x00000203D5E5B000-memory.dmp
memory/1804-141-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/1804-140-0x000002251BCF0000-0x000002251BD1B000-memory.dmp
memory/1896-149-0x0000020F1FE00000-0x0000020F1FE2B000-memory.dmp
memory/1896-150-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/2016-144-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/2016-143-0x0000012DDF220000-0x0000012DDF24B000-memory.dmp
memory/2120-152-0x0000018126B30000-0x0000018126B5B000-memory.dmp
memory/2120-153-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/2128-156-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/2128-155-0x00000265F2CC0000-0x00000265F2CEB000-memory.dmp
memory/2304-158-0x000001E3E5FA0000-0x000001E3E5FCB000-memory.dmp
memory/2304-159-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/2312-161-0x000001B8D6F50000-0x000001B8D6F7B000-memory.dmp
memory/2312-162-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/2416-164-0x00000299E46D0000-0x00000299E46FB000-memory.dmp
memory/2416-165-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/2520-168-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/2520-167-0x000002082DFC0000-0x000002082DFEB000-memory.dmp
memory/2568-170-0x000001E1A4E80000-0x000001E1A4EAB000-memory.dmp
memory/2568-171-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/2664-173-0x000001C64FE90000-0x000001C64FEBB000-memory.dmp
memory/2664-174-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/2688-177-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/2688-176-0x00000278789D0000-0x00000278789FB000-memory.dmp
memory/3380-100-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/3380-442-0x0000000000D00000-0x0000000000D2B000-memory.dmp
memory/3380-320-0x0000000000D00000-0x0000000000D2B000-memory.dmp
memory/3380-99-0x0000000000D00000-0x0000000000D2B000-memory.dmp
memory/4128-3-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4128-2-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4128-1-0x00007FFF84B0F000-0x00007FFF84B10000-memory.dmp
memory/4128-9-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4128-364-0x0000026F199B0000-0x0000026F199C8000-memory.dmp
memory/4128-321-0x0000026F7F920000-0x0000026F7F930000-memory.dmp
memory/4128-23-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4128-0-0x0000026F7E380000-0x0000026F7E3F8000-memory.dmp
memory/4128-8-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4128-7-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4128-4-0x0000026F19650000-0x0000026F1967C000-memory.dmp
memory/4128-5-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4128-432-0x00007FFF84980000-0x00007FFF85324000-memory.dmp
memory/4344-319-0x000001E4C0290000-0x000001E4C02BB000-memory.dmp
memory/4344-86-0x00007FFF679C0000-0x00007FFF679D0000-memory.dmp
memory/4344-441-0x000001E4C0290000-0x000001E4C02BB000-memory.dmp
memory/4344-85-0x000001E4C0290000-0x000001E4C02BB000-memory.dmp
memory/4764-17-0x00007FFFA7880000-0x00007FFFA7AE3000-memory.dmp
memory/4764-18-0x00007FFFA68B0000-0x00007FFFA6977000-memory.dmp