Analysis
- user interaction
yes - max time kernel
150s - max time network
152s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
02/10/2026, 07:02
General
- Target MasonClient.exe
- Size 1.6MB
- Sample261002-htt3ssxsdv
- SHA256 8f3f93c5f53d1b36e8dbc5ad0123f5b89776a79af2cd676fb1595e39187a6e25
Malware Config
Extracted
-
neptunerat
-
30.tcp.cpolar.top:14990
-
filename
USB.exe
-
group
MasonGroup
-
key
VzK63fZifMmPLaSN
-
rat_name
MasonRAT
Signatures
- Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
- Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
- Detects DonutLoader 1 IoCs
- Detects NeptuneRAT stealer 1 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 1 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 5 IoCs
- Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
- Loads dropped DLL 1 IoCs
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 12 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies data under HKEY_USERS 64 IoCs
- Modifies registry class 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 5 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of UnmapMainImage 1 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{f84bef80-3b0d-4e86-9404-9b0e126bdb1b}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-c255110d-43e3-48b5-9620-6d7499eb1856 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a744ad40-d2fb-4750-9838-eabe7e578559 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-1a21e101-1ce5-4615-b5b6-a72d32d247a0 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-4cb228e9-d97c-4845-ac16-8de12c865b3a -LifetimeId:47a68d56-7dc4-444d-a082-e29a28c0b712 -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
- Indicator Removal: Clear Windows Event Logs
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
C:\Users\Admin\AppData\Roaming\MasonMasonClient.exe"C:\Users\Admin\AppData\Roaming\MasonMasonClient.exe"2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\MasonMasonClient.exe"C:\Users\Admin\AppData\Roaming\MasonMasonClient.exe"2⤵
- Loads dropped DLL
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
- Enumerates connected drives
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"C:\Users\Admin\AppData\Local\Temp\MasonClient.exe"2⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonKit.exe"C:\Users\Admin\AppData\Local\Temp\MasonKit.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"C:\Users\Admin\AppData\Local\Temp\MasonRootkit.exe"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp90C2.tmp.bat""4⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
-
C:\Windows\system32\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Roaming\MasonMasonClient.exe"C:\Users\Admin\AppData\Roaming\MasonMasonClient.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /f /sc minute /mo 1 /tn "MasonMasonClient" /tr "C:\Users\Admin\AppData\Roaming\MasonMasonClient.exe"4⤵
- Scheduled Task/Job: Scheduled Task
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Users\Admin\AppData\Roaming\MasonMasonClient.exeC:\Users\Admin\AppData\Roaming\MasonMasonClient.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Writes to the Master Boot Record (MBR)
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 691ee8888302b7f2ea40334597ded093 PURcI5awHUeqbBBAaRP2Nw.0.1.0.0.01⤵
- Sets service image path in registry
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Access Token Manipulation
1Parent PID Spoofing
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Process Injection
1Process Hollowing
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Access Token Manipulation
1Parent PID Spoofing
1Indicator Removal
1Clear Windows Event Logs
1Modify Registry
1Pre-OS Boot
1Bootkit
1Process Injection
1Process Hollowing
1Replay Monitor
Loading Replay Monitor...
Downloads
MasonMasonClient.exe.log
MasonKit.exe
MasonRootkit.exe
tmp90C2.tmp.bat
MasonMasonClient.exe
Schedule Maintenance Work
Schedule Scan
Schedule Wake To Work
Schedule Work
Schedule Work
Schedule Work
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
memory/440-99-0x0000024D04C80000-0x0000024D04E3B000-memory.dmp
memory/440-104-0x00007FFCC0B10000-0x00007FFCC0B20000-memory.dmp
memory/440-103-0x0000024D04C80000-0x0000024D04E3B000-memory.dmp
memory/440-102-0x0000024D04C80000-0x0000024D04E3B000-memory.dmp
memory/440-101-0x0000024D04C80000-0x0000024D04E3B000-memory.dmp
memory/440-100-0x0000024D04C80000-0x0000024D04E3B000-memory.dmp
memory/456-95-0x00007FFCC0B10000-0x00007FFCC0B20000-memory.dmp
memory/456-94-0x000002C1A1540000-0x000002C1A16FB000-memory.dmp
memory/456-93-0x000002C1A1540000-0x000002C1A16FB000-memory.dmp
memory/456-92-0x000002C1A1540000-0x000002C1A16FB000-memory.dmp
memory/456-91-0x000002C1A1540000-0x000002C1A16FB000-memory.dmp
memory/456-90-0x000002C1A1540000-0x000002C1A16FB000-memory.dmp
memory/600-64-0x00007FFCC0B10000-0x00007FFCC0B20000-memory.dmp
memory/600-63-0x000002408EF40000-0x000002408F0FB000-memory.dmp
memory/600-57-0x000002408EE00000-0x000002408EF3E000-memory.dmp
memory/600-60-0x000002408EF40000-0x000002408F0FB000-memory.dmp
memory/600-59-0x000002408EF40000-0x000002408F0FB000-memory.dmp
memory/600-61-0x000002408EF40000-0x000002408F0FB000-memory.dmp
memory/600-62-0x000002408EF40000-0x000002408F0FB000-memory.dmp
memory/676-68-0x000001E131A00000-0x000001E131BBB000-memory.dmp
memory/676-70-0x000001E131A00000-0x000001E131BBB000-memory.dmp
memory/676-67-0x000001E131A00000-0x000001E131BBB000-memory.dmp
memory/676-69-0x000001E131A00000-0x000001E131BBB000-memory.dmp
memory/676-71-0x00007FFCC0B10000-0x00007FFCC0B20000-memory.dmp
memory/676-66-0x000001E131A00000-0x000001E131BBB000-memory.dmp
memory/696-110-0x00000282B6080000-0x00000282B623B000-memory.dmp
memory/696-109-0x00000282B6080000-0x00000282B623B000-memory.dmp
memory/696-111-0x00007FFCC0B10000-0x00007FFCC0B20000-memory.dmp
memory/696-108-0x00000282B6080000-0x00000282B623B000-memory.dmp
memory/696-107-0x00000282B6080000-0x00000282B623B000-memory.dmp
memory/696-106-0x00000282B6080000-0x00000282B623B000-memory.dmp
memory/816-0-0x00000000006F0000-0x000000000089A000-memory.dmp
memory/816-6-0x000000001B940000-0x000000001B950000-memory.dmp
memory/816-5-0x000000001B940000-0x000000001B950000-memory.dmp
memory/816-4-0x000000001BAF0000-0x000000001BC90000-memory.dmp
memory/816-3-0x000000001B940000-0x000000001B950000-memory.dmp
memory/816-1-0x000000001B350000-0x000000001B4F2000-memory.dmp
memory/880-78-0x000001803A850000-0x000001803AA0B000-memory.dmp
memory/880-79-0x000001803A850000-0x000001803AA0B000-memory.dmp
memory/880-75-0x000001803A850000-0x000001803AA0B000-memory.dmp
memory/880-76-0x000001803A850000-0x000001803AA0B000-memory.dmp
memory/880-80-0x00007FFCC0B10000-0x00007FFCC0B20000-memory.dmp
memory/880-77-0x000001803A850000-0x000001803AA0B000-memory.dmp
memory/1016-87-0x00007FFCC0B10000-0x00007FFCC0B20000-memory.dmp
memory/1016-84-0x00000225B9E10000-0x00000225B9FCB000-memory.dmp
memory/1016-83-0x00000225B9E10000-0x00000225B9FCB000-memory.dmp
memory/1016-82-0x00000225B9E10000-0x00000225B9FCB000-memory.dmp
memory/1016-86-0x00000225B9E10000-0x00000225B9FCB000-memory.dmp
memory/1016-85-0x00000225B9E10000-0x00000225B9FCB000-memory.dmp
memory/1056-131-0x0000018769F40000-0x000001876A0FB000-memory.dmp
memory/1056-129-0x0000018769F40000-0x000001876A0FB000-memory.dmp
memory/1056-132-0x0000018769F40000-0x000001876A0FB000-memory.dmp
memory/1056-130-0x0000018769F40000-0x000001876A0FB000-memory.dmp
memory/1056-133-0x00007FFCC0B10000-0x00007FFCC0B20000-memory.dmp
memory/1056-128-0x0000018769F40000-0x000001876A0FB000-memory.dmp
memory/1076-135-0x0000015CA6800000-0x0000015CA69BB000-memory.dmp
memory/1116-125-0x000001A58BF40000-0x000001A58C0FB000-memory.dmp
memory/1116-126-0x00007FFCC0B10000-0x00007FFCC0B20000-memory.dmp
memory/1116-124-0x000001A58BF40000-0x000001A58C0FB000-memory.dmp
memory/1116-123-0x000001A58BF40000-0x000001A58C0FB000-memory.dmp
memory/1116-122-0x000001A58BF40000-0x000001A58C0FB000-memory.dmp
memory/1116-121-0x000001A58BF40000-0x000001A58C0FB000-memory.dmp
memory/1804-27-0x0000000000570000-0x000000000060C000-memory.dmp
memory/2180-52-0x00007FFD00880000-0x00007FFD0093D000-memory.dmp
memory/2180-48-0x0000000140000000-0x00000001401A1000-memory.dmp
memory/2180-51-0x00007FFD00A90000-0x00007FFD00C88000-memory.dmp
memory/2180-50-0x0000000140000000-0x00000001401A1000-memory.dmp
memory/2180-54-0x0000000140000000-0x00000001401A1000-memory.dmp
memory/2520-43-0x00007FFD00A90000-0x00007FFD00C88000-memory.dmp
memory/2520-44-0x00007FFD00880000-0x00007FFD0093D000-memory.dmp
memory/2520-42-0x00000216C00E0000-0x00000216C017A000-memory.dmp