xworm | 42574c7d99f01e2f6135c83b41b5477214234bd3174f4a2691a87617e7d55bb0

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_bdda197876b05a1ba7fec469b57338d3_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
Size 792KB
Sample260630-eqxsqset2x
SHA256 42574c7d99f01e2f6135c83b41b5477214234bd3174f4a2691a87617e7d55bb0
MD5 bdda197876b05a1ba7fec469b57338d3
SHA1 81a0fa978378fa1e5eea9ba44f00f69a35cb7465
SHA512 92191b5044df520a8a6c666840091d29ccb5f2f0c81a5adf9c26a11a994a1c8b04adf42958fbfc851451060e64b793eb7ced8ab784f2305642d58b6435978303
SSDEEP 12288:ThRAIazF9QrvPXc8tQ7ARygV0kBjp/5/gVziHlBrCbYn8L:TZazy5Wunq+Xb6
TLSH
T1C8058D6EF5BDB19BEC6E49728C131B12A7FBF4E40713E6BBAD4125042E522D00CA765C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm persistence rat trojan

Malware Config

Extracted

Family

xworm

Version

185.27.107.156:6323
:6323

Mutex

9g90u5LseooqUflD

Attributes

Install_directory
%AppData%
install_file
XClient.exe

aes.plain

Extracted

Family

xworm

Mutex

yNحكـX8ٍبAGLWِF6Jo2DiObلٍLZا3ا

Attributes

Install_directory
%Port%
install_file
MicrosoftEdgeUpdateTaskMachineUAC.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 3 IoCs

resource	yara_rule
behavioral2/files/0x002600000001c361-325.dat	family_xworm
behavioral2/memory/4524-339-0x0000000000010000-0x000000000003C000-memory.dmp	family_xworm
behavioral2/memory/4696-369-0x000001DF9DBA0000-0x000001DF9DBAE000-memory.dmp	family_xworm

Detects Windows executables referencing non-Windows User-Agents 3 IoCs

resource	yara_rule
behavioral2/files/0x002600000001c361-325.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4524-339-0x0000000000010000-0x000000000003C000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/4696-369-0x000001DF9DBA0000-0x000001DF9DBAE000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5012	powershell.exe
4960	powershell.exe
2328	powershell.exe
796	powershell.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	zxcv.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk	zxcv.exe

Executes dropped EXE 5 IoCs

pid	Process
5464	3om2sbmo.5ey.exe
4524	zxcv.exe
1252	ExLoader.exe
4700	exloderv1.exe
4708	ExLoader.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Tasks\Mason2026-06-29_bdda197876b05a1ba7fec469b57338d3_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe	svchost.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 16 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "504928405,17110992,7153487,17110988,7202265,507286179,41816131,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={24505A1E-0A88-4DE6-AA06-E2F851FD6A1B}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,940 15,943 10,944 50,940 6,1329 15,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Classes\Local Settings\MuiCache\27\52C64B7E	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Tue, 30 Jun 2026 00:58:26 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1782792591"	OfficeClickToRun.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5904	SCHTASKS.exe
1208	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe
5464	3om2sbmo.5ey.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3460	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4696	2026-06-29_bdda197876b05a1ba7fec469b57338d3_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
Token: SeDebugPrivilege	5464	3om2sbmo.5ey.exe
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeShutdownPrivilege	3460	Explorer.EXE
Token: SeCreatePagefilePrivilege	3460	Explorer.EXE
Token: SeDebugPrivilege	4524	zxcv.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeIncreaseQuotaPrivilege	4960	powershell.exe
Token: SeSecurityPrivilege	4960	powershell.exe
Token: SeTakeOwnershipPrivilege	4960	powershell.exe
Token: SeLoadDriverPrivilege	4960	powershell.exe
Token: SeSystemProfilePrivilege	4960	powershell.exe
Token: SeSystemtimePrivilege	4960	powershell.exe
Token: SeProfSingleProcessPrivilege	4960	powershell.exe
Token: SeIncBasePriorityPrivilege	4960	powershell.exe
Token: SeCreatePagefilePrivilege	4960	powershell.exe
Token: SeBackupPrivilege	4960	powershell.exe
Token: SeRestorePrivilege	4960	powershell.exe
Token: SeShutdownPrivilege	4960	powershell.exe
Token: SeDebugPrivilege	4960	powershell.exe
Token: SeSystemEnvironmentPrivilege	4960	powershell.exe
Token: SeRemoteShutdownPrivilege	4960	powershell.exe
Token: SeUndockPrivilege	4960	powershell.exe
Token: SeManageVolumePrivilege	4960	powershell.exe
Token: 33	4960	powershell.exe
Token: 34	4960	powershell.exe
Token: 35	4960	powershell.exe
Token: 36	4960	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3668	svchost.exe
Token: SeIncreaseQuotaPrivilege	3668	svchost.exe
Token: SeSecurityPrivilege	3668	svchost.exe
Token: SeTakeOwnershipPrivilege	3668	svchost.exe
Token: SeLoadDriverPrivilege	3668	svchost.exe
Token: SeSystemtimePrivilege	3668	svchost.exe
Token: SeBackupPrivilege	3668	svchost.exe
Token: SeRestorePrivilege	3668	svchost.exe
Token: SeShutdownPrivilege	3668	svchost.exe
Token: SeSystemEnvironmentPrivilege	3668	svchost.exe
Token: SeUndockPrivilege	3668	svchost.exe
Token: SeManageVolumePrivilege	3668	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3668	svchost.exe
Token: SeIncreaseQuotaPrivilege	3668	svchost.exe
Token: SeSecurityPrivilege	3668	svchost.exe
Token: SeTakeOwnershipPrivilege	3668	svchost.exe
Token: SeLoadDriverPrivilege	3668	svchost.exe
Token: SeSystemtimePrivilege	3668	svchost.exe
Token: SeBackupPrivilege	3668	svchost.exe
Token: SeRestorePrivilege	3668	svchost.exe
Token: SeShutdownPrivilege	3668	svchost.exe
Token: SeSystemEnvironmentPrivilege	3668	svchost.exe
Token: SeUndockPrivilege	3668	svchost.exe
Token: SeManageVolumePrivilege	3668	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3668	svchost.exe
Token: SeIncreaseQuotaPrivilege	3668	svchost.exe
Token: SeSecurityPrivilege	3668	svchost.exe
Token: SeTakeOwnershipPrivilege	3668	svchost.exe
Token: SeLoadDriverPrivilege	3668	svchost.exe
Token: SeSystemtimePrivilege	3668	svchost.exe
Token: SeBackupPrivilege	3668	svchost.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2712	Conhost.exe
3028	Conhost.exe
3872	Conhost.exe
4524	zxcv.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
4408	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 5464	4696	2026-06-29_bdda197876b05a1ba7fec469b57338d3_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe	87
PID 4696 wrote to memory of 5904	4696	2026-06-29_bdda197876b05a1ba7fec469b57338d3_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe	88
PID 5464 wrote to memory of 744	5464	3om2sbmo.5ey.exe	5
PID 5464 wrote to memory of 964	5464	3om2sbmo.5ey.exe	9
PID 5464 wrote to memory of 968	5464	3om2sbmo.5ey.exe	10
PID 5464 wrote to memory of 544	5464	3om2sbmo.5ey.exe	11
PID 5464 wrote to memory of 1032	5464	3om2sbmo.5ey.exe	13
PID 5464 wrote to memory of 1144	5464	3om2sbmo.5ey.exe	15
PID 5464 wrote to memory of 1200	5464	3om2sbmo.5ey.exe	16
PID 5464 wrote to memory of 1228	5464	3om2sbmo.5ey.exe	17
PID 5464 wrote to memory of 1268	5464	3om2sbmo.5ey.exe	18
PID 5464 wrote to memory of 1372	5464	3om2sbmo.5ey.exe	19
PID 5464 wrote to memory of 1396	5464	3om2sbmo.5ey.exe	20
PID 5464 wrote to memory of 1468	5464	3om2sbmo.5ey.exe	21
PID 5464 wrote to memory of 1536	5464	3om2sbmo.5ey.exe	23
PID 5464 wrote to memory of 1612	5464	3om2sbmo.5ey.exe	25
PID 5464 wrote to memory of 1676	5464	3om2sbmo.5ey.exe	26
PID 5464 wrote to memory of 1820	5464	3om2sbmo.5ey.exe	27
PID 5464 wrote to memory of 1832	5464	3om2sbmo.5ey.exe	28
PID 5464 wrote to memory of 1888	5464	3om2sbmo.5ey.exe	29
PID 5464 wrote to memory of 1248	5464	3om2sbmo.5ey.exe	30
PID 5464 wrote to memory of 1500	5464	3om2sbmo.5ey.exe	31
PID 5464 wrote to memory of 1636	5464	3om2sbmo.5ey.exe	32
PID 5464 wrote to memory of 2072	5464	3om2sbmo.5ey.exe	33
PID 5464 wrote to memory of 2224	5464	3om2sbmo.5ey.exe	34
PID 5464 wrote to memory of 2292	5464	3om2sbmo.5ey.exe	35
PID 5464 wrote to memory of 2368	5464	3om2sbmo.5ey.exe	36
PID 5464 wrote to memory of 2440	5464	3om2sbmo.5ey.exe	37
PID 5464 wrote to memory of 2476	5464	3om2sbmo.5ey.exe	38
PID 5464 wrote to memory of 2576	5464	3om2sbmo.5ey.exe	39
PID 5464 wrote to memory of 2684	5464	3om2sbmo.5ey.exe	40
PID 5464 wrote to memory of 2748	5464	3om2sbmo.5ey.exe	41
PID 5464 wrote to memory of 2764	5464	3om2sbmo.5ey.exe	42
PID 5464 wrote to memory of 2912	5464	3om2sbmo.5ey.exe	43
PID 5464 wrote to memory of 2992	5464	3om2sbmo.5ey.exe	44
PID 5464 wrote to memory of 2044	5464	3om2sbmo.5ey.exe	45
PID 5464 wrote to memory of 2164	5464	3om2sbmo.5ey.exe	46
PID 5464 wrote to memory of 716	5464	3om2sbmo.5ey.exe	47
PID 5464 wrote to memory of 3128	5464	3om2sbmo.5ey.exe	49
PID 5464 wrote to memory of 3192	5464	3om2sbmo.5ey.exe	50
PID 5464 wrote to memory of 3460	5464	3om2sbmo.5ey.exe	52
PID 5464 wrote to memory of 3468	5464	3om2sbmo.5ey.exe	53
PID 5464 wrote to memory of 3588	5464	3om2sbmo.5ey.exe	54
PID 5464 wrote to memory of 3600	5464	3om2sbmo.5ey.exe	55
PID 5464 wrote to memory of 3608	5464	3om2sbmo.5ey.exe	56
PID 5464 wrote to memory of 3668	5464	3om2sbmo.5ey.exe	57
PID 5464 wrote to memory of 3676	5464	3om2sbmo.5ey.exe	58
PID 5464 wrote to memory of 3704	5464	3om2sbmo.5ey.exe	59
PID 5464 wrote to memory of 3288	5464	3om2sbmo.5ey.exe	60
PID 5464 wrote to memory of 908	5464	3om2sbmo.5ey.exe	61
PID 5464 wrote to memory of 4368	5464	3om2sbmo.5ey.exe	64
PID 5464 wrote to memory of 4408	5464	3om2sbmo.5ey.exe	65
PID 5464 wrote to memory of 4488	5464	3om2sbmo.5ey.exe	66
PID 5464 wrote to memory of 4512	5464	3om2sbmo.5ey.exe	67
PID 5464 wrote to memory of 4860	5464	3om2sbmo.5ey.exe	68
PID 5464 wrote to memory of 5104	5464	3om2sbmo.5ey.exe	69
PID 5464 wrote to memory of 1280	5464	3om2sbmo.5ey.exe	70
PID 5464 wrote to memory of 5168	5464	3om2sbmo.5ey.exe	71
PID 5464 wrote to memory of 5204	5464	3om2sbmo.5ey.exe	72
PID 5464 wrote to memory of 5492	5464	3om2sbmo.5ey.exe	75
PID 5464 wrote to memory of 5316	5464	3om2sbmo.5ey.exe	77
PID 5464 wrote to memory of 2304	5464	3om2sbmo.5ey.exe	79
PID 5464 wrote to memory of 3488	5464	3om2sbmo.5ey.exe	80
PID 5464 wrote to memory of 4380	5464	3om2sbmo.5ey.exe	81

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:744
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:968
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1268

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:964

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-80b24de7-65dd-4e9d-b7cf-b9022c121fff -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-f9e22c97-520f-4e31-b689-5c6c20658938 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-939842f7-4e9f-41bd-99cb-83cb3bee2022 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b9860ef2-dc1e-4117-b28c-d99a7e1cb659 -LifetimeId:a1f57243-1a47-45c8-bec8-7654305a0605 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:544

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1032

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1144

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1200

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1372

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1820

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:1636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:2072
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:716
- - C:\Windows\System32\ShellHost.exe
    "C:\Windows\System32\ShellHost.exe"
    3⤵
    PID:3468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2224

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2292

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2368

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2440

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2476
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000270;0000000000000274;
  2⤵
  PID:5104

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2748

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2912

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2992

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3192

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3460
- C:\Windows\System32\SecurityHealthSystray.exe
  "C:\Windows\System32\SecurityHealthSystray.exe"
  2⤵
  PID:5204
- C:\Users\Admin\AppData\Local\Temp\2026-06-29_bdda197876b05a1ba7fec469b57338d3_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-06-29_bdda197876b05a1ba7fec469b57338d3_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Users\Admin\AppData\Local\Temp\3om2sbmo.5ey.exe
    "C:\Users\Admin\AppData\Local\Temp\3om2sbmo.5ey.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5464
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Mason2026-06-29_bdda197876b05a1ba7fec469b57338d3_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-06-29_bdda197876b05a1ba7fec469b57338d3_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5904
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:3720
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Mason2026-06-29_bdda197876b05a1ba7fec469b57338d3_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-06-29_bdda197876b05a1ba7fec469b57338d3_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1208
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4120
- - C:\Users\Admin\AppData\Roaming\zxcv.exe
    "C:\Users\Admin\AppData\Roaming\zxcv.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:4524
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\zxcv.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:4960
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2712
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'zxcv.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2328
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        
        PID:5532
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\XClient.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:796
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'XClient.exe'
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:5012
    - - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:3872
- - C:\Users\Admin\AppData\Roaming\ExLoader.exe
    "C:\Users\Admin\AppData\Roaming\ExLoader.exe"
    3⤵
    - Executes dropped EXE
    PID:1252
- - C:\Users\Admin\AppData\Roaming\exloderv1.exe
    "C:\Users\Admin\AppData\Roaming\exloderv1.exe"
    3⤵
    - Executes dropped EXE
    PID:4700
  - - C:\Users\Admin\AppData\Roaming\ExLoader.exe
      "C:\Users\Admin\AppData\Roaming\ExLoader.exe"
      4⤵
      Executes dropped EXE
      PID:4708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3600

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
- Modifies data under HKEY_USERS
PID:3608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3676

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:908

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4368

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:4408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4488

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4512

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4860

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:1280

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:5316

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3488

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4380

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1916

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:5956

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:1512

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 f1e5d82b5a189ea2be5bcb97eaf21b4ff8cb785bf14b9b7d0c3532a3cd068d60
MD5 22f0ffaa212f3eff78593bfdeee03662
SHA1 1464dfc97fd5c12669e86a3ebf2c748910c3a0c0
SHA512 cfa263d4dc671f524387464ef486912af1d32d2ca39594a346e17f511050f9ef98e8c20f042c67e367ba60eaa39abdb1d677bb570ed9d05101e17b8441faeb63
TLSH
T170216833B3DD8614CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 8a7adb8fb9f5fc689fffe5ccfc7cce2ffcc7053900bd33691d9d833b49c48d1b
MD5 1a5d00edf0cde96b81ce006952be8524
SHA1 0d549bb4e998773fa81d85c49608c32e304d2805
SHA512 916d87b52b61579c5b8143802c4cc8981cda04b1865244d3cdf7dae0a0f9442cc63f6eb61e682be3645b924ebd1172101971ebc72b74e2367e9ef959f7c2ca32
TLSH
T12A21BE33B3CC8210C899013A10CDAC1036B6C7DB40DECFAB7B80D655A43F698CF60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d392673060a6e1bb0310b43ca1297d406be264a70db13697cab65f25b617667b
MD5 3709055742b554c0dce0910d1eb0021f
SHA1 d731ff7a00f5b701bc03b960ec7ee0ba45a0c7b0
SHA512 f626b7f34fe248a7b71dda2c8953520a0bb9d83a84abf2f21e4c375a620d61d64e4fa7429399834f90188904207eca41a51140b18915b30028b0dbf65b15ccc0
TLSH
T1F6216833B3DD8624C89A413A10CDAC1036B6C7DB41DECFAB6B84E659A43F699DE61160
MD5 SHA1 SHA512 TLSH

Submit Download

3om2sbmo.5ey.exe

Path C:\Users\Admin\AppData\Local\Temp\3om2sbmo.5ey.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_bf4f0pwy.anh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bf4f0pwy.anh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ExLoader.exe

Path C:\Users\Admin\AppData\Roaming\ExLoader.exe
Size 201KB
SHA256 ee980ee74993c9b31989f38a15e353f4181ed37b721eebff69ec73f489b27bee
MD5 742b9ff7d57fa917eab0b69c9a041c0e
SHA1 f2601d5dc9d55cc7a99c4eed3824ccdc06e0c96c
SHA512 24b7de92a120aa075323650504c16ed2a9e12caa4f46e32ce9198360c776499ec4243c9dd7d0a349f32fb5828762ff269e3162226b05002d2398b760c183e3c9
SSDEEP 3072:IGM+Ytzin7g4AU+O1NQtLbU/5YZjtHx6hVzZuZqv8PwKreqbpmiY0UX:JM+6in7jAU+O1NQ1AuAhVIZxwKreqB
TLSH
T1CE14D015FF16009BD2094E74D8138E09EA72F88E5BF196CBB7405EDA6E375C4AF3A601
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XClient.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk
Size 771B
SHA256 4ea006823a5c864f3328ed47ddec31eff4b3c5027f9012ff718fd710aa55e658
MD5 db4e705a344a7662b8e1fb6e0b3567ae
SHA1 9eba9cec7937bd475bb34a79772390a4e1155f38
SHA512 68f50f37f296f648a38189e9be98423d5aa09db7c6be1b33a5d1392cb19dff5064c97a064ad95c24d19242164b54af27e9f709f8e6aa8e3e3285695c4c64eb42
TLSH
T1D5019E553FC13B9AE191E77514F7E7B0E13BEA97E3939F485500824D9C08743EE4A906
MD5 SHA1 SHA512 TLSH

Submit Download

exloderv1.exe

Path C:\Users\Admin\AppData\Roaming\exloderv1.exe
Size 221KB
SHA256 3fd179d07b376551ea8893652d5d3db0bf44fe5c0cdac9b0c3d7d8802c067496
MD5 4e344d3f72edbc990a5f5d66247b223b
SHA1 29f2c8dfadbf645776e09e4a8ac22ce536e542f7
SHA512 b590397c6263bd64861746d500e6b1e88d4ad81dd697db056488188fd0ef1bfb45691e321d59d04b771385fdf411bc780fc25bea68fbe0d6d23bacef8b6f6dd9
SSDEEP 3072:vY1EvqbJZkQfn9cvij6Ex3PB8SDUike5eJ2EOlKiZID+jIJSOgnGc4hcX8z:vY1Guz8ijQgHo4EMK/T1Lc4hcX8
TLSH
T11324CE77419762D2C3FCE2F668A7733016BF8E889C5EC74A0E5B2BC82919508D947763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zxcv.exe

Path C:\Users\Admin\AppData\Roaming\zxcv.exe
Size 151KB
SHA256 1679ee913132a9a50e0930780417c600ecb5b57300992fdfd21502317656869a
MD5 be862107aa0168649c710340694e7588
SHA1 94bfc8ba1a04bca5dd945f0e8092764f762697f0
SHA512 91d03463fcf7815674b3d15dfc62c87de799f60f2c3532193047cac466508597fce17779acef925c25b179c2f10eddfd17a2ea2af8aa4cbd5f5061f6e7a5bb1f
SSDEEP 3072:ZpTUO1FJ930OMh4NpVq8BxFRzaqF+o2GQJ7/JzqVfGv+:ZpTpJ9SgVqwlL
TLSH
T11CE3B4698EEBB242C45A54747973A3824B395F79A4CF75158EE33FED1BB3C9410230A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/544-106-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/544-105-0x00000235C3C70000-0x00000235C3C9B000-memory.dmp

Download

memory/744-286-0x0000017025410000-0x000001702543B000-memory.dmp

Download

memory/744-15-0x00000170253E0000-0x0000017025405000-memory.dmp

Download

memory/744-16-0x0000017025410000-0x000001702543B000-memory.dmp

Download

memory/744-17-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/964-287-0x000001EE20E60000-0x000001EE20E8B000-memory.dmp

Download

memory/964-26-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/964-22-0x000001EE20E60000-0x000001EE20E8B000-memory.dmp

Download

memory/968-288-0x0000027550030000-0x000002755005B000-memory.dmp

Download

memory/968-24-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/968-23-0x0000027550030000-0x000002755005B000-memory.dmp

Download

memory/1032-108-0x00000221DD640000-0x00000221DD66B000-memory.dmp

Download

memory/1032-109-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/1144-111-0x000001B2B3E50000-0x000001B2B3E7B000-memory.dmp

Download

memory/1200-113-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/1200-112-0x000002AC6BDE0000-0x000002AC6BE0B000-memory.dmp

Download

memory/1228-116-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/1228-115-0x000001E4C9490000-0x000001E4C94BB000-memory.dmp

Download

memory/1248-143-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/1248-142-0x000001D20E750000-0x000001D20E77B000-memory.dmp

Download

memory/1268-34-0x0000023419190000-0x00000234191BB000-memory.dmp

Download

memory/1268-35-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/1268-289-0x0000023419190000-0x00000234191BB000-memory.dmp

Download

memory/1372-118-0x0000024169480000-0x00000241694AB000-memory.dmp

Download

memory/1372-119-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/1396-121-0x0000025F32400000-0x0000025F3242B000-memory.dmp

Download

memory/1396-122-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/1468-41-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/1468-290-0x00000176C66A0000-0x00000176C66CB000-memory.dmp

Download

memory/1468-40-0x00000176C66A0000-0x00000176C66CB000-memory.dmp

Download

memory/1500-145-0x00000237BCFC0000-0x00000237BCFEB000-memory.dmp

Download

memory/1500-146-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/1536-126-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/1536-124-0x000001CAADF70000-0x000001CAADF9B000-memory.dmp

Download

memory/1612-127-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/1612-125-0x0000017109150000-0x000001710917B000-memory.dmp

Download

memory/1636-148-0x000001D871810000-0x000001D87183B000-memory.dmp

Download

memory/1636-149-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/1676-130-0x0000028F17E10000-0x0000028F17E3B000-memory.dmp

Download

memory/1676-131-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/1820-134-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/1820-133-0x000001C5E1E20000-0x000001C5E1E4B000-memory.dmp

Download

memory/1832-136-0x00000165B2C40000-0x00000165B2C6B000-memory.dmp

Download

memory/1832-137-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/1888-140-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/1888-139-0x000001ACFCE90000-0x000001ACFCEBB000-memory.dmp

Download

memory/2072-151-0x0000018767250000-0x000001876727B000-memory.dmp

Download

memory/2072-152-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/2224-155-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/2224-154-0x000001B7343C0000-0x000001B7343EB000-memory.dmp

Download

memory/2292-157-0x0000021306040000-0x000002130606B000-memory.dmp

Download

memory/2292-158-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/2368-161-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/2368-160-0x000001B9C8E40000-0x000001B9C8E6B000-memory.dmp

Download

memory/2440-163-0x00000238F9000000-0x00000238F902B000-memory.dmp

Download

memory/2440-164-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/2476-167-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/2476-166-0x000002448CBA0000-0x000002448CBCB000-memory.dmp

Download

memory/2576-170-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/2576-169-0x000002A901490000-0x000002A9014BB000-memory.dmp

Download

memory/2684-172-0x000001BAF4680000-0x000001BAF46AB000-memory.dmp

Download

memory/2684-173-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/3460-70-0x0000000002EE0000-0x0000000002F0B000-memory.dmp

Download

memory/3460-71-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/3460-291-0x0000000002EE0000-0x0000000002F0B000-memory.dmp

Download

memory/4524-339-0x0000000000010000-0x000000000003C000-memory.dmp

Download

memory/4696-5-0x00007FFF50870000-0x00007FFF51214000-memory.dmp

Download

memory/4696-0-0x00007FFF509FF000-0x00007FFF50A00000-memory.dmp

Download

memory/4696-310-0x000001DF9DAD0000-0x000001DF9DB6A000-memory.dmp

Download

memory/4696-1-0x000001DF83090000-0x000001DF8315C000-memory.dmp

Download

memory/4696-471-0x000001DF9D9C0000-0x000001DF9D9D0000-memory.dmp

Download

memory/4696-2-0x000001DF84D60000-0x000001DF84D8C000-memory.dmp

Download

memory/4696-21-0x00007FFF50870000-0x00007FFF51214000-memory.dmp

Download

memory/4696-360-0x000001DF9D9C0000-0x000001DF9D9D0000-memory.dmp

Download

memory/4696-369-0x000001DF9DBA0000-0x000001DF9DBAE000-memory.dmp

Download

memory/4696-438-0x00007FFF50870000-0x00007FFF51214000-memory.dmp

Download

memory/4696-4-0x00007FFF50870000-0x00007FFF51214000-memory.dmp

Download

memory/4700-361-0x0000000000320000-0x000000000035E000-memory.dmp

Download

memory/4960-381-0x000001DDF0870000-0x000001DDF0892000-memory.dmp

Download

memory/4960-388-0x000001DDF0CC0000-0x000001DDF0CCA000-memory.dmp

Download

memory/4960-387-0x000001DDF0B00000-0x000001DDF0BB2000-memory.dmp

Download

memory/4960-386-0x000001DDF0AE0000-0x000001DDF0AFE000-memory.dmp

Download

memory/5104-292-0x000001918CEB0000-0x000001918CEDB000-memory.dmp

Download

memory/5104-88-0x000001918CEB0000-0x000001918CEDB000-memory.dmp

Download

memory/5104-89-0x00007FFF337E0000-0x00007FFF337F0000-memory.dmp

Download

memory/5464-13-0x00007FFF736A0000-0x00007FFF73903000-memory.dmp

Download

memory/5464-14-0x00007FFF717B0000-0x00007FFF71877000-memory.dmp

Download