1abb8141f24044d5928e7be1218e7ba0a494e56d9b284062715743e1ee6c4582

Analysis

max time kernel
135s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
29/05/2026, 17:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-29_c2a4c09977e8f3783063b486a18cee69_cobalt-strike_elex_glassworm_icedid_vidar.exe
Size 537KB
Sample260529-v7vmpsdv5n
SHA256 1abb8141f24044d5928e7be1218e7ba0a494e56d9b284062715743e1ee6c4582
MD5 c2a4c09977e8f3783063b486a18cee69
SHA1 d56fbf18747bbbb9b045fe6f6a015ea7f05b2048
SHA512 f99c093f6ccc9a0c441a11750f7e717d9ea2ab52596784548357e48f825879c82a31341ea5fe31bc915deca7b241875d3bafa30f1063cde2c1481f90b0cfdbdd
SSDEEP 12288:xnaHZ/CVqdIYSrBUREJkP04dQ/5/gVziHlBrCbYF8W:a/XBSreREJi04dOXbd
TLSH
T1D8C49D52F7A080ABE5BE4274DD63170167B5F0365221EBDB3A8805AD7F633804D277AB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion execution persistence

Malware Config

Signatures

Executes dropped EXE 9 IoCs

pid	Process
3212	1h2upvrq.0or.exe
132	WUDFHost.exe
2340	krzcd5nk.c1z.exe
548	WUDFHost.exe
5952	yzbnhyeu.lpp.exe
4676	WUDFHost.exe
4652	ihwhhmwp.nxk.exe
4712	WUDFHost.exe
1416	a4vj5sab.vx3.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 2 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CloudStore%4Operational.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Storsvc%4Diagnostic.evtx	svchost.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\Mason2026-05-29_c2a4c09977e8f3783063b486a18cee69_cobalt-strike_elex_glassworm_icedid_vidar.exe	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\MicrosoftEdgeUpdateTaskMachineCoreUAC{78F382DB-0303-40AE-A80B-51537E33362A}	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\MasonWUDFHost.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 50,1329 10,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5912	SCHTASKS.exe
928	SCHTASKS.exe
5392	SCHTASKS.exe
3584	SCHTASKS.exe
4360	SCHTASKS.exe
2584	SCHTASKS.exe
2456	SCHTASKS.exe
3204	SCHTASKS.exe
4868	SCHTASKS.exe
5160	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe
3212	1h2upvrq.0or.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3196	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	4028	2026-05-29_c2a4c09977e8f3783063b486a18cee69_cobalt-strike_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	3212	1h2upvrq.0or.exe
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeDebugPrivilege	132	WUDFHost.exe
Token: SeDebugPrivilege	2340	krzcd5nk.c1z.exe
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeShutdownPrivilege	3196	Explorer.EXE
Token: SeCreatePagefilePrivilege	3196	Explorer.EXE
Token: SeDebugPrivilege	548	WUDFHost.exe
Token: SeDebugPrivilege	5952	yzbnhyeu.lpp.exe
Token: SeDebugPrivilege	4676	WUDFHost.exe
Token: SeDebugPrivilege	4652	ihwhhmwp.nxk.exe
Token: SeShutdownPrivilege	448	dwm.exe
Token: SeCreatePagefilePrivilege	448	dwm.exe
Token: SeDebugPrivilege	4712	WUDFHost.exe
Token: SeDebugPrivilege	1416	a4vj5sab.vx3.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3368	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 3212	4028	2026-05-29_c2a4c09977e8f3783063b486a18cee69_cobalt-strike_elex_glassworm_icedid_vidar.exe	80
PID 4028 wrote to memory of 2456	4028	2026-05-29_c2a4c09977e8f3783063b486a18cee69_cobalt-strike_elex_glassworm_icedid_vidar.exe	81
PID 3212 wrote to memory of 644	3212	1h2upvrq.0or.exe	5
PID 3212 wrote to memory of 696	3212	1h2upvrq.0or.exe	7
PID 3212 wrote to memory of 912	3212	1h2upvrq.0or.exe	11
PID 3212 wrote to memory of 360	3212	1h2upvrq.0or.exe	13
PID 3212 wrote to memory of 448	3212	1h2upvrq.0or.exe	14
PID 3212 wrote to memory of 1060	3212	1h2upvrq.0or.exe	15
PID 3212 wrote to memory of 1124	3212	1h2upvrq.0or.exe	17
PID 3212 wrote to memory of 1180	3212	1h2upvrq.0or.exe	18
PID 3212 wrote to memory of 1200	3212	1h2upvrq.0or.exe	19
PID 3212 wrote to memory of 1192	3212	1h2upvrq.0or.exe	20
PID 3212 wrote to memory of 1228	3212	1h2upvrq.0or.exe	21
PID 3212 wrote to memory of 1296	3212	1h2upvrq.0or.exe	22
PID 3212 wrote to memory of 1352	3212	1h2upvrq.0or.exe	23
PID 3212 wrote to memory of 1408	3212	1h2upvrq.0or.exe	24
PID 3212 wrote to memory of 1420	3212	1h2upvrq.0or.exe	25
PID 3212 wrote to memory of 1496	3212	1h2upvrq.0or.exe	26
PID 3212 wrote to memory of 1660	3212	1h2upvrq.0or.exe	27
PID 3212 wrote to memory of 1768	3212	1h2upvrq.0or.exe	28
PID 3212 wrote to memory of 1840	3212	1h2upvrq.0or.exe	29
PID 3212 wrote to memory of 1852	3212	1h2upvrq.0or.exe	30
PID 3212 wrote to memory of 1860	3212	1h2upvrq.0or.exe	31
PID 3212 wrote to memory of 1972	3212	1h2upvrq.0or.exe	32
PID 3212 wrote to memory of 2000	3212	1h2upvrq.0or.exe	33
PID 3212 wrote to memory of 1620	3212	1h2upvrq.0or.exe	34
PID 3212 wrote to memory of 2036	3212	1h2upvrq.0or.exe	35
PID 3212 wrote to memory of 1612	3212	1h2upvrq.0or.exe	36
PID 3212 wrote to memory of 2140	3212	1h2upvrq.0or.exe	37
PID 3212 wrote to memory of 2156	3212	1h2upvrq.0or.exe	38
PID 3212 wrote to memory of 2240	3212	1h2upvrq.0or.exe	39
PID 3212 wrote to memory of 2352	3212	1h2upvrq.0or.exe	41
PID 3212 wrote to memory of 2468	3212	1h2upvrq.0or.exe	42
PID 3212 wrote to memory of 2620	3212	1h2upvrq.0or.exe	43
PID 3212 wrote to memory of 2648	3212	1h2upvrq.0or.exe	44
PID 3212 wrote to memory of 2716	3212	1h2upvrq.0or.exe	46
PID 3212 wrote to memory of 2748	3212	1h2upvrq.0or.exe	47
PID 3212 wrote to memory of 2760	3212	1h2upvrq.0or.exe	48
PID 3212 wrote to memory of 2768	3212	1h2upvrq.0or.exe	49
PID 3212 wrote to memory of 2788	3212	1h2upvrq.0or.exe	50
PID 3212 wrote to memory of 2696	3212	1h2upvrq.0or.exe	51
PID 3212 wrote to memory of 812	3212	1h2upvrq.0or.exe	52
PID 3212 wrote to memory of 1560	3212	1h2upvrq.0or.exe	53
PID 3212 wrote to memory of 3196	3212	1h2upvrq.0or.exe	54
PID 3212 wrote to memory of 3336	3212	1h2upvrq.0or.exe	55
PID 3212 wrote to memory of 3396	3212	1h2upvrq.0or.exe	56
PID 3212 wrote to memory of 3720	3212	1h2upvrq.0or.exe	59
PID 3212 wrote to memory of 3788	3212	1h2upvrq.0or.exe	60
PID 3212 wrote to memory of 3832	3212	1h2upvrq.0or.exe	61
PID 3212 wrote to memory of 3892	3212	1h2upvrq.0or.exe	62
PID 3212 wrote to memory of 4120	3212	1h2upvrq.0or.exe	63
PID 3212 wrote to memory of 4328	3212	1h2upvrq.0or.exe	64
PID 3212 wrote to memory of 5260	3212	1h2upvrq.0or.exe	67
PID 3212 wrote to memory of 5344	3212	1h2upvrq.0or.exe	68
PID 3212 wrote to memory of 5556	3212	1h2upvrq.0or.exe	69
PID 3212 wrote to memory of 3820	3212	1h2upvrq.0or.exe	70
PID 3212 wrote to memory of 2400	3212	1h2upvrq.0or.exe	71
PID 3212 wrote to memory of 1380	3212	1h2upvrq.0or.exe	72
PID 3212 wrote to memory of 5444	3212	1h2upvrq.0or.exe	73
PID 3212 wrote to memory of 1964	3212	1h2upvrq.0or.exe	74
PID 3212 wrote to memory of 4072	3212	1h2upvrq.0or.exe	75
PID 3212 wrote to memory of 4112	3212	1h2upvrq.0or.exe	76
PID 3212 wrote to memory of 2152	3212	1h2upvrq.0or.exe	77
PID 3212 wrote to memory of 4028	3212	1h2upvrq.0or.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:644
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:448

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:696

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7adf84e1-a044-4858-972d-2d5be99dbb29 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-69d13624-e2dd-4188-bad7-edef7815b13b -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-59630c5e-bf90-4633-b42b-d7204d5b4feb -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3cf6a14a-2e30-4c55-9595-0e4b8355f881 -LifetimeId:bce93bfc-8ba0-4968-b08d-cbdf3ec11ea3 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:1060

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1124

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1180
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:1560
- C:\Users\Admin\AppData\Roaming\WUDFHost.exe
  C:\Users\Admin\AppData\Roaming\WUDFHost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:548
- - C:\Users\Admin\AppData\Local\Temp\yzbnhyeu.lpp.exe
    "C:\Users\Admin\AppData\Local\Temp\yzbnhyeu.lpp.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5952
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonWUDFHost.exe" /tr "'C:\Users\Admin\AppData\Roaming\WUDFHost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:928
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2888
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonWUDFHost.exe" /tr "'C:\Users\Admin\AppData\Roaming\WUDFHost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5392
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2644
- C:\Users\Admin\AppData\Roaming\WUDFHost.exe
  C:\Users\Admin\AppData\Roaming\WUDFHost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4676
- - C:\Users\Admin\AppData\Local\Temp\ihwhhmwp.nxk.exe
    "C:\Users\Admin\AppData\Local\Temp\ihwhhmwp.nxk.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:4652
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonWUDFHost.exe" /tr "'C:\Users\Admin\AppData\Roaming\WUDFHost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5160
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3852
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonWUDFHost.exe" /tr "'C:\Users\Admin\AppData\Roaming\WUDFHost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3584
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:936
- C:\Users\Admin\AppData\Roaming\WUDFHost.exe
  C:\Users\Admin\AppData\Roaming\WUDFHost.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4712
- - C:\Users\Admin\AppData\Local\Temp\a4vj5sab.vx3.exe
    "C:\Users\Admin\AppData\Local\Temp\a4vj5sab.vx3.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:1416
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonWUDFHost.exe" /tr "'C:\Users\Admin\AppData\Roaming\WUDFHost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4360
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4448
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "MasonWUDFHost.exe" /tr "'C:\Users\Admin\AppData\Roaming\WUDFHost.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2584
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1192

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1352
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1420

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1852

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1860

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1972

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2000

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1620

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2036

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2156

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2240

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2352

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2620

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2768

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2788

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:812

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3196
- C:\Users\Admin\AppData\Local\Temp\2026-05-29_c2a4c09977e8f3783063b486a18cee69_cobalt-strike_elex_glassworm_icedid_vidar.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-29_c2a4c09977e8f3783063b486a18cee69_cobalt-strike_elex_glassworm_icedid_vidar.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Users\Admin\AppData\Local\Temp\1h2upvrq.0or.exe
    "C:\Users\Admin\AppData\Local\Temp\1h2upvrq.0or.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3212
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Mason2026-05-29_c2a4c09977e8f3783063b486a18cee69_cobalt-strike_elex_glassworm_icedid_vidar.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-05-29_c2a4c09977e8f3783063b486a18cee69_cobalt-strike_elex_glassworm_icedid_vidar.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2456
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Mason2026-05-29_c2a4c09977e8f3783063b486a18cee69_cobalt-strike_elex_glassworm_icedid_vidar.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-05-29_c2a4c09977e8f3783063b486a18cee69_cobalt-strike_elex_glassworm_icedid_vidar.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5912
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:944

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3396

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3720

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3788

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:3892

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:4120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4328

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:5260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
1⤵
PID:5344

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:5556

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3820

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:2400

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:5444

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:1964

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:4072

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
PID:2152

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:908

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:568

C:\Users\Admin\AppData\Roaming\WUDFHost.exe
C:\Users\Admin\AppData\Roaming\WUDFHost.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:132
- C:\Users\Admin\AppData\Local\Temp\krzcd5nk.c1z.exe
  "C:\Users\Admin\AppData\Local\Temp\krzcd5nk.c1z.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2340
- C:\Windows\system32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "MasonWUDFHost.exe" /tr "'C:\Users\Admin\AppData\Roaming\WUDFHost.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3204
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1320
- C:\Windows\system32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "MasonWUDFHost.exe" /tr "'C:\Users\Admin\AppData\Roaming\WUDFHost.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4868
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5256

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:3368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

WUDFHost.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\WUDFHost.exe.log
Size 1KB
SHA256 374333df81a1cf018517ec193189d3e66cd6540f6c5a88a3ae5b43436d74cd3f
MD5 7aef94c3e26c531595b6099824b806b8
SHA1 2b724de889ec08590734373e7acb6378550ff30b
SHA512 58d36d089ecd5891280be7a7831c2116ba818ca35f92be7b2ad33b206452247047927df94999c4938ec7bcce3ae82e2d7b5d1fdf7437763c69284e321b07fab8
TLSH
T17821CD312372A1C889263F421C1D268423EF832AB650EE0C7A98635DDD2705B5B212F3
MD5 SHA1 SHA512 TLSH

Submit Download

1h2upvrq.0or.exe

Path C:\Users\Admin\AppData\Local\Temp\1h2upvrq.0or.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WUDFHost.exe

Path C:\Users\Admin\AppData\Roaming\WUDFHost.exe
Size 537KB
SHA256 1abb8141f24044d5928e7be1218e7ba0a494e56d9b284062715743e1ee6c4582
MD5 c2a4c09977e8f3783063b486a18cee69
SHA1 d56fbf18747bbbb9b045fe6f6a015ea7f05b2048
SHA512 f99c093f6ccc9a0c441a11750f7e717d9ea2ab52596784548357e48f825879c82a31341ea5fe31bc915deca7b241875d3bafa30f1063cde2c1481f90b0cfdbdd
SSDEEP 12288:xnaHZ/CVqdIYSrBUREJkP04dQ/5/gVziHlBrCbYF8W:a/XBSreREJi04dOXbd
TLSH
T1D8C49D52F7A080ABE5BE4274DD63170167B5F0365221EBDB3A8805AD7F633804D277AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/132-508-0x000001FFF22B0000-0x000001FFF22DC000-memory.dmp

Download

memory/132-329-0x000001FFEE1B0000-0x000001FFEE23C000-memory.dmp

Download

memory/360-32-0x0000016E2FA90000-0x0000016E2FABB000-memory.dmp

Download

memory/360-82-0x0000016E2FA90000-0x0000016E2FABB000-memory.dmp

Download

memory/360-33-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/360-36-0x0000016E2FA90000-0x0000016E2FABB000-memory.dmp

Download

memory/448-29-0x000001F56C230000-0x000001F56C25B000-memory.dmp

Download

memory/448-35-0x000001F56C230000-0x000001F56C25B000-memory.dmp

Download

memory/448-30-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/548-518-0x000002599CDA0000-0x000002599CE2C000-memory.dmp

Download

memory/644-20-0x0000027599D20000-0x0000027599D4B000-memory.dmp

Download

memory/644-12-0x0000027599CF0000-0x0000027599D15000-memory.dmp

Download

memory/644-13-0x0000027599D20000-0x0000027599D4B000-memory.dmp

Download

memory/644-14-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/696-21-0x0000021AF8F00000-0x0000021AF8F2B000-memory.dmp

Download

memory/696-17-0x0000021AF8F00000-0x0000021AF8F2B000-memory.dmp

Download

memory/696-18-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/912-23-0x000001AFFA0F0000-0x000001AFFA11B000-memory.dmp

Download

memory/912-26-0x000001AFFA0F0000-0x000001AFFA11B000-memory.dmp

Download

memory/912-24-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/912-75-0x000001AFFA0F0000-0x000001AFFA11B000-memory.dmp

Download

memory/1060-39-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/1060-872-0x00000230C8770000-0x00000230C879B000-memory.dmp

Download

memory/1060-41-0x00000230C8770000-0x00000230C879B000-memory.dmp

Download

memory/1060-144-0x00000230C8770000-0x00000230C879B000-memory.dmp

Download

memory/1060-38-0x00000230C8770000-0x00000230C879B000-memory.dmp

Download

memory/1124-46-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/1124-45-0x000001D644C90000-0x000001D644CBB000-memory.dmp

Download

memory/1124-54-0x000001D644C90000-0x000001D644CBB000-memory.dmp

Download

memory/1124-303-0x000001D644C90000-0x000001D644CBB000-memory.dmp

Download

memory/1180-49-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/1180-304-0x00000297723C0000-0x00000297723EB000-memory.dmp

Download

memory/1180-55-0x00000297723C0000-0x00000297723EB000-memory.dmp

Download

memory/1180-48-0x00000297723C0000-0x00000297723EB000-memory.dmp

Download

memory/1192-59-0x000001BDC5120000-0x000001BDC514B000-memory.dmp

Download

memory/1192-60-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/1192-65-0x000001BDC5120000-0x000001BDC514B000-memory.dmp

Download

memory/1192-316-0x000001BDC5120000-0x000001BDC514B000-memory.dmp

Download

memory/1200-51-0x0000023BF2860000-0x0000023BF288B000-memory.dmp

Download

memory/1200-56-0x0000023BF2860000-0x0000023BF288B000-memory.dmp

Download

memory/1200-305-0x0000023BF2860000-0x0000023BF288B000-memory.dmp

Download

memory/1200-52-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/1228-62-0x000001738C940000-0x000001738C96B000-memory.dmp

Download

memory/1228-317-0x000001738C940000-0x000001738C96B000-memory.dmp

Download

memory/1228-66-0x000001738C940000-0x000001738C96B000-memory.dmp

Download

memory/1228-63-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/1296-502-0x000001DA9DC00000-0x000001DA9DC2B000-memory.dmp

Download

memory/1296-70-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/1296-69-0x000001DA9DC00000-0x000001DA9DC2B000-memory.dmp

Download

memory/1296-76-0x000001DA9DC00000-0x000001DA9DC2B000-memory.dmp

Download

memory/1352-72-0x000001E3E5B40000-0x000001E3E5B6B000-memory.dmp

Download

memory/1352-77-0x000001E3E5B40000-0x000001E3E5B6B000-memory.dmp

Download

memory/1352-503-0x000001E3E5B40000-0x000001E3E5B6B000-memory.dmp

Download

memory/1352-73-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/1408-83-0x00000276F4DA0000-0x00000276F4DCB000-memory.dmp

Download

memory/1408-620-0x00000276F4DA0000-0x00000276F4DCB000-memory.dmp

Download

memory/1408-80-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/1408-79-0x00000276F4DA0000-0x00000276F4DCB000-memory.dmp

Download

memory/1420-145-0x000001BD3EAA0000-0x000001BD3EACB000-memory.dmp

Download

memory/1420-100-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/1420-99-0x000001BD3EAA0000-0x000001BD3EACB000-memory.dmp

Download

memory/1420-692-0x000001BD3EAA0000-0x000001BD3EACB000-memory.dmp

Download

memory/1496-146-0x000002729BFA0000-0x000002729BFCB000-memory.dmp

Download

memory/1496-103-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/1496-102-0x000002729BFA0000-0x000002729BFCB000-memory.dmp

Download

memory/1612-133-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/1612-132-0x0000019CF3430000-0x0000019CF345B000-memory.dmp

Download

memory/1620-127-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/1620-126-0x0000017C2A370000-0x0000017C2A39B000-memory.dmp

Download

memory/1660-693-0x0000018C226B0000-0x0000018C226DB000-memory.dmp

Download

memory/1660-105-0x0000018C226B0000-0x0000018C226DB000-memory.dmp

Download

memory/1660-106-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/1660-147-0x0000018C226B0000-0x0000018C226DB000-memory.dmp

Download

memory/1768-109-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/1768-694-0x0000019AC92B0000-0x0000019AC92DB000-memory.dmp

Download

memory/1768-148-0x0000019AC92B0000-0x0000019AC92DB000-memory.dmp

Download

memory/1768-108-0x0000019AC92B0000-0x0000019AC92DB000-memory.dmp

Download

memory/1840-695-0x000002ACC8D60000-0x000002ACC8D8B000-memory.dmp

Download

memory/1840-112-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/1840-149-0x000002ACC8D60000-0x000002ACC8D8B000-memory.dmp

Download

memory/1840-111-0x000002ACC8D60000-0x000002ACC8D8B000-memory.dmp

Download

memory/1852-115-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/1852-696-0x000001EB20BB0000-0x000001EB20BDB000-memory.dmp

Download

memory/1852-150-0x000001EB20BB0000-0x000001EB20BDB000-memory.dmp

Download

memory/1852-114-0x000001EB20BB0000-0x000001EB20BDB000-memory.dmp

Download

memory/1860-118-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/1860-151-0x000001FDEB460000-0x000001FDEB48B000-memory.dmp

Download

memory/1860-117-0x000001FDEB460000-0x000001FDEB48B000-memory.dmp

Download

memory/1972-120-0x000001EF5AD90000-0x000001EF5ADBB000-memory.dmp

Download

memory/1972-121-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/2000-124-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/2000-123-0x000001FA9C720000-0x000001FA9C74B000-memory.dmp

Download

memory/2036-130-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/2036-129-0x00000265BD260000-0x00000265BD28B000-memory.dmp

Download

memory/2140-136-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/2140-135-0x0000020E844F0000-0x0000020E8451B000-memory.dmp

Download

memory/2156-138-0x000001E733370000-0x000001E73339B000-memory.dmp

Download

memory/2156-139-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/2240-142-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/2240-141-0x0000000001260000-0x000000000128B000-memory.dmp

Download

memory/2352-154-0x00007FFB1D0F0000-0x00007FFB1D100000-memory.dmp

Download

memory/2352-153-0x00000294B21D0000-0x00000294B21FB000-memory.dmp

Download

memory/2468-163-0x000002D494700000-0x000002D49472B000-memory.dmp

Download

memory/3212-10-0x00007FFB5D060000-0x00007FFB5D269000-memory.dmp

Download

memory/3212-11-0x00007FFB5C210000-0x00007FFB5C2CD000-memory.dmp

Download

memory/4028-0-0x0000021B453A0000-0x0000021B4542C000-memory.dmp

Download

memory/4028-506-0x0000021B608C0000-0x0000021B608D0000-memory.dmp

Download

memory/4028-308-0x0000021B60860000-0x0000021B608BA000-memory.dmp

Download

memory/4028-1-0x0000021B45830000-0x0000021B4585C000-memory.dmp

Download

memory/4676-704-0x0000025842530000-0x00000258425BC000-memory.dmp

Download