Analysis
- max time kernel
126s - max time network
150s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260911-en - resource tags
- submitted
07/11/2026, 19:29
General
- Target win40ed.exe
- Size 2.3MB
- Sample261107-x7fjwsft7k
- SHA256 5c05c8d9ff8205af0d9b581fdfdc257cc59b6c729fa0d5060a2f48a932675d79
Malware Config
Signatures
- Family: njRAT/Bladabindi
Widely used RAT written in .NET.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 TTPs 2 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 TTPs 2 IoCs
- Modifies Windows Firewall 2 TTPs 1 IoCs
- Sets service image path in registry 3 TTPs 1 IoCs
This determines the executable launched when a service starts. It can be used to establish persistence.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Executes dropped EXE 4 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Drops file in System32 directory 16 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates video capture drivers 2 TTPs 1 IoCs
Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 15 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 7 IoCs
- Modifies data under HKEY_USERS 24 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of UnmapMainImage 1 TTPs 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
- Drops file in System32 directory
-
C:\Windows\System32\WUDFHost.exe"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-1478189d-0339-4be5-baed-3b8bb2c48b2d -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-6967e003-792c-4c76-b30c-c4ce20f28e68 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-a15dcc9c-9702-4865-8f9e-0dea4943d7d9 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-bd511c82-6ea9-4053-8b0c-165f59906266 -LifetimeId:23aa16a4-2775-49c5-9376-7e8a37a969ea -DeviceGroupId:WudfDefaultDevicePool -HostArg:01⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s nsi1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule1⤵
- Drops file in System32 directory
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager1⤵
-
C:\Windows\system32\sihost.exesihost.exe2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s SENS1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s netprofm1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc1⤵
- Drops file in System32 directory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\win40ed.exe"C:\Users\Admin\AppData\Local\Temp\win40ed.exe"2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\z1oocy4n.syo.exe"C:\Users\Admin\AppData\Local\Temp\z1oocy4n.syo.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masonwin40ed.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\win40ed.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masonwin40ed.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\win40ed.exe'" /sc onlogon /rl HIGHEST3⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\3fz5uwd5.rfy.exe"C:\Users\Admin\AppData\Local\Temp\3fz5uwd5.rfy.exe"3⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Adds Run key to start application
- Enumerates video capture drivers
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\3fz5uwd5.rfy.exe" "3fz5uwd5.rfy.exe" ENABLE4⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
- Suspicious use of SetWindowsHookEx
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4652 -s 16403⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc1⤵
- Modifies data under HKEY_USERS
-
C:\Windows\system32\SppExtComObj.exeC:\Windows\system32\SppExtComObj.exe -Embedding1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo1⤵
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 2329051d3354e29754530f5f9b02ab25 oeoOjeZKNkm+O+Pmvg4w7g.0.1.0.0.01⤵
- Sets service image path in registry
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV12⤵
-
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\win40ed.exe"C:\Users\Admin\AppData\Local\Temp\win40ed.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\bqpxugsn.abm.exe"C:\Users\Admin\AppData\Local\Temp\bqpxugsn.abm.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masonwin40ed.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\win40ed.exe'" /sc onlogon /rl HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Windows\system32\SCHTASKS.exe"SCHTASKS.exe" /create /tn "Masonwin40ed.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\win40ed.exe'" /sc onlogon /rl HIGHEST2⤵
- Scheduled Task/Job: Scheduled Task
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\ob5ghilq.03k.exe"C:\Users\Admin\AppData\Local\Temp\ob5ghilq.03k.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 688 -s 13482⤵
- Checks processor information in registry
- Enumerates system info in registry
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k WerSvcGroup1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 468 -p 4652 -ip 46522⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 464 -p 688 -ip 6882⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
-
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\UsoClient.exeC:\Windows\system32\usoclient.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Access Token Manipulation
2Parent PID Spoofing
2Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
2Windows Service
2Event Triggered Execution
1Netsh Helper DLL
1Process Injection
1Process Hollowing
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Access Token Manipulation
2Parent PID Spoofing
2Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
2Process Injection
1Process Hollowing
1Replay Monitor
Loading Replay Monitor...
Downloads
WERA43A.tmp.csv
WERA45A.tmp.txt
WERAE3E.tmp.csv
WERAE5F.tmp.txt
3fz5uwd5.rfy.exe
jla0fifm.y2n.exe
z1oocy4n.syo.exe
Schedule Maintenance Work
Schedule Wake To Work
Schedule Wake To Work
Schedule Wake To Work
Schedule Work
E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
memory/64-31-0x000001FC19210000-0x000001FC1923B000-memory.dmp
memory/64-32-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/620-18-0x000001C2C7870000-0x000001C2C7895000-memory.dmp
memory/620-20-0x000001C2C7C40000-0x000001C2C7C6B000-memory.dmp
memory/620-22-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/676-24-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/676-21-0x000001A8CEEE0000-0x000001A8CEF0B000-memory.dmp
memory/708-35-0x000001A20F8C0000-0x000001A20F8EB000-memory.dmp
memory/708-36-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/892-28-0x00000277F6830000-0x00000277F685B000-memory.dmp
memory/892-29-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/952-41-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/952-40-0x00000266CD5B0000-0x00000266CD5DB000-memory.dmp
memory/1028-44-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1028-43-0x00000135C6140000-0x00000135C616B000-memory.dmp
memory/1104-53-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1104-52-0x0000021109D00000-0x0000021109D2B000-memory.dmp
memory/1144-57-0x000001B72F690000-0x000001B72F6BB000-memory.dmp
memory/1144-58-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1152-49-0x0000017547BA0000-0x0000017547BCB000-memory.dmp
memory/1152-50-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1236-60-0x0000025CA1180000-0x0000025CA11AB000-memory.dmp
memory/1236-61-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1320-64-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1320-63-0x0000017374EC0000-0x0000017374EEB000-memory.dmp
memory/1472-73-0x000002C1B97B0000-0x000002C1B97DB000-memory.dmp
memory/1472-74-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1488-76-0x0000023530090000-0x00000235300BB000-memory.dmp
memory/1488-77-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1496-79-0x0000020689300000-0x000002068932B000-memory.dmp
memory/1496-80-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1504-82-0x000001F9B8390000-0x000001F9B83BB000-memory.dmp
memory/1504-83-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1564-85-0x00000220FCAD0000-0x00000220FCAFB000-memory.dmp
memory/1564-86-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1732-88-0x000001ECBD2E0000-0x000001ECBD30B000-memory.dmp
memory/1732-89-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1764-91-0x000001873CDD0000-0x000001873CDFB000-memory.dmp
memory/1764-92-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1772-113-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1772-112-0x000001FBF9090000-0x000001FBF90BB000-memory.dmp
memory/1796-131-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1796-130-0x000002896F530000-0x000002896F55B000-memory.dmp
memory/1808-115-0x000001C0EBDC0000-0x000001C0EBDEB000-memory.dmp
memory/1808-116-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1860-134-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1860-133-0x0000023D157A0000-0x0000023D157CB000-memory.dmp
memory/1888-128-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1888-127-0x000002339B1D0000-0x000002339B1FB000-memory.dmp
memory/1900-118-0x0000020223BA0000-0x0000020223BCB000-memory.dmp
memory/1900-119-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1948-122-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/1948-121-0x0000017DE0DA0000-0x0000017DE0DCB000-memory.dmp
memory/2036-124-0x0000028EA7F40000-0x0000028EA7F6B000-memory.dmp
memory/2036-125-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/2132-137-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/2132-136-0x000001FF73A60000-0x000001FF73A8B000-memory.dmp
memory/2228-140-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/2228-138-0x0000000000F10000-0x0000000000F3B000-memory.dmp
memory/2272-142-0x0000025570400000-0x000002557042B000-memory.dmp
memory/2272-143-0x00007FFB2A6F0000-0x00007FFB2A700000-memory.dmp
memory/2348-145-0x0000021DC9B30000-0x0000021DC9B5B000-memory.dmp
memory/4104-17-0x00007FFB68F50000-0x00007FFB6900D000-memory.dmp
memory/4104-16-0x00007FFB6A670000-0x00007FFB6A868000-memory.dmp
memory/4652-304-0x0000021973290000-0x00000219732C0000-memory.dmp
memory/4652-0-0x00000219703D0000-0x0000021970628000-memory.dmp
memory/4652-4-0x0000021972B00000-0x0000021972B2C000-memory.dmp
memory/4652-3-0x0000021972E60000-0x0000021973022000-memory.dmp
memory/4652-2-0x0000021972B40000-0x0000021972B50000-memory.dmp
memory/4652-1-0x0000021972B40000-0x0000021972B50000-memory.dmp