Analysis
- max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
10/09/2026, 14:29
General
- Target IDE.exe
- Size 541KB
- Sample260910-rt1d9ahc86
- SHA256 2ac1f77d4c19b7ffe889518899019669542ee32a5ed5d37bf2c043d23e6c65e9
Malware Config
Extracted
-
xworm
-
5.0
-
31.6.50.206:2018
-
install_file
Mason.exe
Signatures
- Family: Xworm
Xworm is a remote access trojan written in C#.
- Detect Xworm Payload 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- ConfuserEx .NET packer 5 IoCs
Detects ConfuserEx .NET packer.
- Drops file in System32 directory 19 IoCs
- Drops file in Windows directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 18 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Drops file in System32 directory
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-71e508ee-036e-4ee0-ba71-9a267c65cba6 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e248d994-086c-4dd1-be22-2a0f6053492b -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ce340ecd-8cd0-442a-a789-f5e4c3f0ce47 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-267bc6de-de89-4c0c-941c-c61c873cbde1 -LifetimeId:4f2a1082-f385-4c80-b70d-8b0aab9ed097 -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
C:\ProgramData\IDE.exeC:\ProgramData\IDE.exe2⤵
- Executes dropped EXE
-
-
C:\ProgramData\IDE.exeC:\ProgramData\IDE.exe2⤵
- Executes dropped EXE
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Enumerates connected drives
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\IDE.exe"C:\Users\Admin\AppData\Local\Temp\IDE.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'IDE.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\IDE.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\ProgramData\IDE.exe'3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /rl highest /tn "IDE" /tr "C:\ProgramData\IDE.exe"3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Users\Admin\AppData\Local\Temp\uklo33nx.1nk.exe"C:\Users\Admin\AppData\Local\Temp\uklo33nx.1nk.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "MasonIDE.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\IDE.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "MasonIDE.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\IDE.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\ProgramData\IDE.exeC:\ProgramData\IDE.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Enumerates system info in registry
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 6781a5feabcd24e3896eb2b7aee1fb56 wJ5G6aMInkWPTlkquyOzMA.0.1.0.0.01⤵
- Sets service image path in registry
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1Clear Windows Event Logs
1Modify Registry
1Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
IDE.exe
config.json
IDE.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_iagzcdvm.hg0.ps1
uklo33nx.1nk.exe
Preferred
Schedule Work
Schedule Work
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
memory/440-60-0x0000024F1C5F0000-0x0000024F1C61B000-memory.dmp
memory/440-61-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/620-50-0x0000026290400000-0x000002629042B000-memory.dmp
memory/620-49-0x00000262903D0000-0x00000262903F5000-memory.dmp
memory/620-51-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/684-55-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/684-54-0x000001BB67500000-0x000001BB6752B000-memory.dmp
memory/876-70-0x00000245DB460000-0x00000245DB48B000-memory.dmp
memory/876-71-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/880-63-0x00000176B2DB0000-0x00000176B2DDB000-memory.dmp
memory/880-64-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1008-67-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1008-66-0x0000028A6C1A0000-0x0000028A6C1CB000-memory.dmp
memory/1060-80-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1060-79-0x0000026470A60000-0x0000026470A8B000-memory.dmp
memory/1140-82-0x000002133BCE0000-0x000002133BD0B000-memory.dmp
memory/1140-83-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1148-86-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1148-85-0x000001DBC6CC0000-0x000001DBC6CEB000-memory.dmp
memory/1176-88-0x0000019A8EB70000-0x0000019A8EB9B000-memory.dmp
memory/1176-89-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1192-91-0x000001E275830000-0x000001E27585B000-memory.dmp
memory/1192-92-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1288-94-0x0000028DCD5D0000-0x0000028DCD5FB000-memory.dmp
memory/1288-95-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1344-99-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1344-98-0x000001A1EC780000-0x000001A1EC7AB000-memory.dmp
memory/1364-103-0x000001E7F0800000-0x000001E7F082B000-memory.dmp
memory/1364-104-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1412-106-0x000002156D5B0000-0x000002156D5DB000-memory.dmp
memory/1412-107-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1452-117-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1452-116-0x000001CE68F30000-0x000001CE68F5B000-memory.dmp
memory/1548-120-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1548-119-0x000001BD83DB0000-0x000001BD83DDB000-memory.dmp
memory/1604-156-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1604-155-0x000001FCD0770000-0x000001FCD079B000-memory.dmp
memory/1736-123-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1736-122-0x000001ABEFA60000-0x000001ABEFA8B000-memory.dmp
memory/1744-125-0x000001DB54E90000-0x000001DB54EBB000-memory.dmp
memory/1744-126-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1788-128-0x00000231AFF70000-0x00000231AFF9B000-memory.dmp
memory/1788-129-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1892-131-0x0000016E31D60000-0x0000016E31D8B000-memory.dmp
memory/1892-132-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1912-134-0x00000235C9F60000-0x00000235C9F8B000-memory.dmp
memory/1912-135-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/1940-152-0x000001A60F0E0000-0x000001A60F10B000-memory.dmp
memory/1940-153-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/2052-159-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/2052-158-0x00000258D4F90000-0x00000258D4FBB000-memory.dmp
memory/2072-161-0x0000023675B90000-0x0000023675BBB000-memory.dmp
memory/2072-162-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/2148-165-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/2148-164-0x000001E0E74B0000-0x000001E0E74DB000-memory.dmp
memory/2180-167-0x000001A1C25A0000-0x000001A1C25CB000-memory.dmp
memory/2180-168-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/2236-170-0x0000022C24740000-0x0000022C2476B000-memory.dmp
memory/2236-171-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/2328-173-0x0000000001110000-0x000000000113B000-memory.dmp
memory/2328-174-0x00007FFC97970000-0x00007FFC97980000-memory.dmp
memory/2440-176-0x000002C217960000-0x000002C21798B000-memory.dmp
memory/2996-577-0x0000000000550000-0x00000000005DE000-memory.dmp
memory/3264-48-0x00007FFCD6BB0000-0x00007FFCD6C6E000-memory.dmp
memory/3264-45-0x00007FFCD78F0000-0x00007FFCD7AE5000-memory.dmp
memory/3276-10-0x000002232A320000-0x000002232A342000-memory.dmp
memory/3276-2-0x0000022329A60000-0x0000022329A70000-memory.dmp
memory/3276-3-0x0000022329A60000-0x0000022329A70000-memory.dmp
memory/3440-324-0x000000001CFF0000-0x000000001CFFE000-memory.dmp
memory/3440-35-0x000000001C400000-0x000000001C440000-memory.dmp
memory/3440-34-0x000000001B990000-0x000000001B9A0000-memory.dmp
memory/3440-36-0x000000001CCF0000-0x000000001CD1C000-memory.dmp
memory/3440-1-0x000000001B8F0000-0x000000001B976000-memory.dmp
memory/3440-0-0x0000000000C70000-0x0000000000CFE000-memory.dmp
memory/4040-425-0x0000000000920000-0x00000000009AE000-memory.dmp