Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/09/2026, 11:01
General
- Target Squidward.exe
- Size 535KB
- Sample260908-m4kdkafa58
- SHA256 2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d
Malware Config
Signatures
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 20 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 7 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Drops file in System32 directory
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7013f752-e6bb-4955-9275-c019138eed34 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a8ba9f00-b1ba-466c-823e-3d44b62bfc72 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-15ea3328-f431-40f3-8937-722710d608cc -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-5a2ee527-d1db-489f-a9ce-614999b99b23 -LifetimeId:095bd999-a459-4a8d-afc4-dcb369bf075b -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x500 0x5042⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Enumerates connected drives
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\Squidward.exe"C:\Users\Admin\AppData\Local\Temp\Squidward.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe"C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE35B.tmp.bat""3⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Enumerates system info in registry
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 8a1f6c2171ce5d5f31b77824400e1fe1 dQq94uSsbk+Fg0ckX6idCw.0.1.0.0.01⤵
- Sets service image path in registry
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1Clear Windows Event Logs
1Modify Registry
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
config.json
MasonGDI.exe
MasonMBR-SLEEP.exe
MasonRootkit.exe
tmpB5AA.tmp
tmpE35B.tmp.bat
Preferred
Preferred
Schedule Maintenance Work
Schedule Maintenance Work
Schedule Wake To Work
Schedule Wake To Work
Schedule Work
57C8EDB95DF3F0AD4EE2DC2B8CFD4157
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
memory/516-54-0x0000022E094A0000-0x0000022E094CB000-memory.dmp
memory/516-55-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/612-44-0x0000023095C50000-0x0000023095C7B000-memory.dmp
memory/612-42-0x0000023095C20000-0x0000023095C45000-memory.dmp
memory/612-45-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/640-159-0x0000000005760000-0x00000000057F2000-memory.dmp
memory/640-41-0x0000000000D10000-0x0000000000D26000-memory.dmp
memory/664-46-0x0000019A5A790000-0x0000019A5A7BB000-memory.dmp
memory/664-48-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/880-57-0x000001D2D7F90000-0x000001D2D7FBB000-memory.dmp
memory/880-58-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/980-77-0x000002884DF00000-0x000002884DF2B000-memory.dmp
memory/980-90-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1016-68-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1016-65-0x000001B397DA0000-0x000001B397DCB000-memory.dmp
memory/1048-111-0x00000234D0C60000-0x00000234D0C8B000-memory.dmp
memory/1048-113-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1160-118-0x0000022FD17C0000-0x0000022FD17EB000-memory.dmp
memory/1160-121-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1168-126-0x00000205B9090000-0x00000205B90BB000-memory.dmp
memory/1168-128-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1224-133-0x0000016DB66E0000-0x0000016DB670B000-memory.dmp
memory/1224-135-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1236-142-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1236-140-0x00000286262D0000-0x00000286262FB000-memory.dmp
memory/1324-145-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1324-144-0x000002674CFA0000-0x000002674CFCB000-memory.dmp
memory/1344-147-0x0000017899A00000-0x0000017899A2B000-memory.dmp
memory/1344-148-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1364-154-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1364-153-0x000001BC92D80000-0x000001BC92DAB000-memory.dmp
memory/1456-150-0x0000025D94AF0000-0x0000025D94B1B000-memory.dmp
memory/1456-151-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1508-156-0x000001B6813A0000-0x000001B6813CB000-memory.dmp
memory/1508-157-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1548-160-0x000002391AAB0000-0x000002391AADB000-memory.dmp
memory/1548-161-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1588-163-0x00000182599B0000-0x00000182599DB000-memory.dmp
memory/1588-164-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1612-166-0x0000021B79130000-0x0000021B7915B000-memory.dmp
memory/1612-167-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1784-169-0x000001E60A560000-0x000001E60A58B000-memory.dmp
memory/1784-170-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1820-185-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1820-184-0x000002C2DC790000-0x000002C2DC7BB000-memory.dmp
memory/1848-188-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1848-187-0x000001C4B6000000-0x000001C4B602B000-memory.dmp
memory/1892-173-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1892-172-0x0000022C9A5B0000-0x0000022C9A5DB000-memory.dmp
memory/1920-176-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1920-175-0x000002210F890000-0x000002210F8BB000-memory.dmp
memory/1928-179-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/1928-178-0x000001D13E760000-0x000001D13E78B000-memory.dmp
memory/2024-182-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/2024-180-0x0000018E89DB0000-0x0000018E89DDB000-memory.dmp
memory/2088-190-0x0000021232570000-0x000002123259B000-memory.dmp
memory/2088-191-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/2140-194-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/2140-193-0x000001BBFDBA0000-0x000001BBFDBCB000-memory.dmp
memory/2148-196-0x00000139952F0000-0x000001399531B000-memory.dmp
memory/2148-197-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/2248-199-0x0000000001730000-0x000000000175B000-memory.dmp
memory/2980-27-0x0000000000FF0000-0x0000000001006000-memory.dmp
memory/3264-106-0x0000000002B80000-0x0000000002BAB000-memory.dmp
memory/3264-107-0x00007FFEDF4B0000-0x00007FFEDF4C0000-memory.dmp
memory/4368-40-0x00007FFF1D7D0000-0x00007FFF1D88E000-memory.dmp
memory/4368-37-0x00007FFF1F430000-0x00007FFF1F625000-memory.dmp
memory/4568-0-0x0000000000190000-0x000000000021C000-memory.dmp
memory/4568-2-0x00000000022A0000-0x00000000022E2000-memory.dmp
memory/4568-1-0x000000001AD20000-0x000000001AD30000-memory.dmp