xworm | c4bd1c7bb7eda7d44bfc49d1580cb36ddf862ac7cd123b5ff014915325a42547

Analysis

max time kernel
75s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
Size 231KB
Sample260831-m5ff1azgpc
SHA256 c4bd1c7bb7eda7d44bfc49d1580cb36ddf862ac7cd123b5ff014915325a42547
MD5 58cc31a8f2c54182147d4a862089c062
SHA1 94cc40b16607eef97dccff28ee6aef8c4bf4c807
SHA512 0f52900f352015a9fdfba7cca77c080d4333cd223e174a08341793296e9be34263d2d1856608c32b52c95de43c8f16322172fb976cf285383e52755df997b4e8
SSDEEP 6144:sx7soh9Z/5bTgVziHzZnSKrCbYMc6bu8tq:s7sw/5/gVziHlBrCbYz80
TLSH
T109343966F6A000FAD4BA42748D636B06B7B2F0360721DBEF1B94495D7F637E04D29B90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

45.88.9.218:3333

Attributes

install_file
Mason.exe

aes.plain

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 7 IoCs

resource	yara_rule
behavioral2/memory/2060-0-0x00000225F1C20000-0x00000225F1C60000-memory.dmp	family_xworm
behavioral2/memory/2060-309-0x00000225F3C30000-0x00000225F3C3E000-memory.dmp	family_xworm
behavioral2/memory/5136-318-0x000001782F6A0000-0x000001782F6E0000-memory.dmp	family_xworm
behavioral2/files/0x000600000000043e-526.dat	family_xworm
behavioral2/memory/2596-710-0x000001FC466A0000-0x000001FC466E0000-memory.dmp	family_xworm
behavioral2/memory/3484-932-0x0000019C56D60000-0x0000019C56DA0000-memory.dmp	family_xworm
behavioral2/memory/5928-1111-0x00000223ED950000-0x00000223ED990000-memory.dmp	family_xworm

Detects Windows executables referencing non-Windows User-Agents 7 IoCs

resource	yara_rule
behavioral2/memory/2060-0-0x00000225F1C20000-0x00000225F1C60000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/2060-309-0x00000225F3C30000-0x00000225F3C3E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/5136-318-0x000001782F6A0000-0x000001782F6E0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/files/0x000600000000043e-526.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/2596-710-0x000001FC466A0000-0x000001FC466E0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/3484-932-0x0000019C56D60000-0x0000019C56DA0000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral2/memory/5928-1111-0x00000223ED950000-0x00000223ED990000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.lnk	2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.lnk	2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe

Executes dropped EXE 6 IoCs

pid	Process
3788	ajh3oozy.1oo.exe
4880	s2uy0hz5.agr.exe
5948	2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
5912	d4r3n3g4.jem.exe
2596	2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
2336	4sqtycja.a0f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm = "C:\\Users\\Admin\\AppData\\Roaming\\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe"	2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Mason2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe	svchost.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_30070D1E013A39CA7A94F919F7922FDF	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 52 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1788174184"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,940 15,943 10,944 50,940 6,1329 15,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "504928405,17110992,7153487,17110988,7202265,507286179,41816131,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6028	SCHTASKS.exe
3172	SCHTASKS.exe
2456	SCHTASKS.exe
3472	SCHTASKS.exe
3524	SCHTASKS.exe
3216	SCHTASKS.exe
1824	SCHTASKS.exe
3300	schtasks.exe
4796	SCHTASKS.exe
6116	SCHTASKS.exe
1984	SCHTASKS.exe
1112	SCHTASKS.exe
4852	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
3788	ajh3oozy.1oo.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe
4880	s2uy0hz5.agr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3872	explorer.exe

Suspicious use of AdjustPrivilegeToken 53 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
Token: SeDebugPrivilege	3788	ajh3oozy.1oo.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeDebugPrivilege	5136	2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
Token: SeDebugPrivilege	4880	s2uy0hz5.agr.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeAuditPrivilege	3624	svchost.exe
Token: SeDebugPrivilege	5948	2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
Token: SeDebugPrivilege	5912	d4r3n3g4.jem.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeDebugPrivilege	2336	4sqtycja.a0f.exe
Token: SeDebugPrivilege	2596	2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe
Token: SeShutdownPrivilege	3872	explorer.exe
Token: SeCreatePagefilePrivilege	3872	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2444	Conhost.exe
2756	Conhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 3788	2060	2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe	89
PID 2060 wrote to memory of 1824	2060	2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe	90
PID 3788 wrote to memory of 736	3788	ajh3oozy.1oo.exe	5
PID 3788 wrote to memory of 952	3788	ajh3oozy.1oo.exe	9
PID 3788 wrote to memory of 960	3788	ajh3oozy.1oo.exe	10
PID 3788 wrote to memory of 540	3788	ajh3oozy.1oo.exe	11
PID 3788 wrote to memory of 500	3788	ajh3oozy.1oo.exe	13
PID 3788 wrote to memory of 1088	3788	ajh3oozy.1oo.exe	14
PID 3788 wrote to memory of 1172	3788	ajh3oozy.1oo.exe	15
PID 3788 wrote to memory of 1224	3788	ajh3oozy.1oo.exe	16
PID 3788 wrote to memory of 1244	3788	ajh3oozy.1oo.exe	17
PID 3788 wrote to memory of 1312	3788	ajh3oozy.1oo.exe	18
PID 3788 wrote to memory of 1348	3788	ajh3oozy.1oo.exe	19
PID 3788 wrote to memory of 1504	3788	ajh3oozy.1oo.exe	22
PID 3788 wrote to memory of 1512	3788	ajh3oozy.1oo.exe	23
PID 3788 wrote to memory of 1592	3788	ajh3oozy.1oo.exe	24
PID 3788 wrote to memory of 1604	3788	ajh3oozy.1oo.exe	25
PID 3788 wrote to memory of 1756	3788	ajh3oozy.1oo.exe	26
PID 3788 wrote to memory of 1776	3788	ajh3oozy.1oo.exe	27
PID 3788 wrote to memory of 1892	3788	ajh3oozy.1oo.exe	28
PID 3788 wrote to memory of 1304	3788	ajh3oozy.1oo.exe	29
PID 3788 wrote to memory of 1396	3788	ajh3oozy.1oo.exe	30
PID 3788 wrote to memory of 1500	3788	ajh3oozy.1oo.exe	31
PID 3788 wrote to memory of 2132	3788	ajh3oozy.1oo.exe	32
PID 3788 wrote to memory of 2200	3788	ajh3oozy.1oo.exe	33
PID 3788 wrote to memory of 2296	3788	ajh3oozy.1oo.exe	34
PID 3788 wrote to memory of 2348	3788	ajh3oozy.1oo.exe	35
PID 3788 wrote to memory of 2468	3788	ajh3oozy.1oo.exe	36
PID 3788 wrote to memory of 2536	3788	ajh3oozy.1oo.exe	37
PID 3788 wrote to memory of 2556	3788	ajh3oozy.1oo.exe	38
PID 3788 wrote to memory of 2572	3788	ajh3oozy.1oo.exe	39
PID 3788 wrote to memory of 2700	3788	ajh3oozy.1oo.exe	40
PID 3788 wrote to memory of 2724	3788	ajh3oozy.1oo.exe	41
PID 3788 wrote to memory of 2928	3788	ajh3oozy.1oo.exe	42
PID 3788 wrote to memory of 2964	3788	ajh3oozy.1oo.exe	43
PID 3788 wrote to memory of 2156	3788	ajh3oozy.1oo.exe	44
PID 3788 wrote to memory of 1420	3788	ajh3oozy.1oo.exe	45
PID 3788 wrote to memory of 3152	3788	ajh3oozy.1oo.exe	47
PID 3788 wrote to memory of 3196	3788	ajh3oozy.1oo.exe	48
PID 3788 wrote to memory of 3476	3788	ajh3oozy.1oo.exe	50
PID 3788 wrote to memory of 3568	3788	ajh3oozy.1oo.exe	51
PID 3788 wrote to memory of 3624	3788	ajh3oozy.1oo.exe	52
PID 3788 wrote to memory of 3632	3788	ajh3oozy.1oo.exe	53
PID 3788 wrote to memory of 3648	3788	ajh3oozy.1oo.exe	54
PID 3788 wrote to memory of 3676	3788	ajh3oozy.1oo.exe	55
PID 3788 wrote to memory of 3684	3788	ajh3oozy.1oo.exe	56
PID 3788 wrote to memory of 3256	3788	ajh3oozy.1oo.exe	57
PID 3788 wrote to memory of 880	3788	ajh3oozy.1oo.exe	58
PID 3788 wrote to memory of 4372	3788	ajh3oozy.1oo.exe	59
PID 3788 wrote to memory of 4432	3788	ajh3oozy.1oo.exe	60
PID 3788 wrote to memory of 4504	3788	ajh3oozy.1oo.exe	61
PID 3788 wrote to memory of 4584	3788	ajh3oozy.1oo.exe	62
PID 3788 wrote to memory of 4640	3788	ajh3oozy.1oo.exe	63
PID 3788 wrote to memory of 4928	3788	ajh3oozy.1oo.exe	64
PID 3788 wrote to memory of 5080	3788	ajh3oozy.1oo.exe	65
PID 3788 wrote to memory of 5188	3788	ajh3oozy.1oo.exe	66
PID 3788 wrote to memory of 5232	3788	ajh3oozy.1oo.exe	67
PID 3788 wrote to memory of 5588	3788	ajh3oozy.1oo.exe	70
PID 3788 wrote to memory of 1288	3788	ajh3oozy.1oo.exe	73
PID 3788 wrote to memory of 3076	3788	ajh3oozy.1oo.exe	74
PID 3788 wrote to memory of 2232	3788	ajh3oozy.1oo.exe	75
PID 3788 wrote to memory of 2120	3788	ajh3oozy.1oo.exe	78
PID 3788 wrote to memory of 3040	3788	ajh3oozy.1oo.exe	79
PID 3788 wrote to memory of 5584	3788	ajh3oozy.1oo.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:736
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:952
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1172

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:960

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-04ce446c-2077-4b03-8526-e5e19e3ff376 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ebe9caa4-8cdf-4107-8a32-74aefd1a262e -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-eaa8f509-34bb-4b48-bbfa-fbcf3a3c4d18 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-b567394e-d95a-42c3-b708-b4a5ab727686 -LifetimeId:828e17fb-dbce-4a5f-aded-a416af24d565 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1088

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1244

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1348

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1512

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1604
- C:\Users\Admin\AppData\Roaming\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
  "C:\Users\Admin\AppData\Roaming\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5948
- - C:\Users\Admin\AppData\Local\Temp\d4r3n3g4.jem.exe
    "C:\Users\Admin\AppData\Local\Temp\d4r3n3g4.jem.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    PID:5912
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Mason2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Roaming\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4796
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2124
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Mason2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Roaming\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6116
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:4272
- C:\Users\Admin\AppData\Roaming\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
  "C:\Users\Admin\AppData\Roaming\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe"
  2⤵
  PID:3484
- - C:\Users\Admin\AppData\Local\Temp\v4i1xgq4.pmd.exe
    "C:\Users\Admin\AppData\Local\Temp\v4i1xgq4.pmd.exe"
    3⤵
    PID:4332
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Mason2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Roaming\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1112
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Mason2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Roaming\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4852
- C:\Users\Admin\AppData\Roaming\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
  "C:\Users\Admin\AppData\Roaming\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe"
  2⤵
  PID:5928
- - C:\Users\Admin\AppData\Local\Temp\zyx50ib0.ggk.exe
    "C:\Users\Admin\AppData\Local\Temp\zyx50ib0.ggk.exe"
    3⤵
    PID:4608
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Mason2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Roaming\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3216
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Mason2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Roaming\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1776

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1500
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5584
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:3872
  - - C:\Users\Admin\AppData\Local\Temp\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe"
      4⤵
      Creates a file in the Startup directory
      Adds Run key to start application
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2060
    - - C:\Users\Admin\AppData\Local\Temp\ajh3oozy.1oo.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ajh3oozy.1oo.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3788
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Mason2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1824
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:916
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Mason2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3172
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5700
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm" /tr "C:\Users\Admin\AppData\Roaming\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3300
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2468

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2536

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2556
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000268;000000000000026C;
  2⤵
  PID:4640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2572

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2928

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2964

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2156

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:1420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3152

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3196

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3568

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3624

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:3648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3684

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3256

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:880

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4372

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4432

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4584

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4928

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5080

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5188

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5232

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:1288

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3076

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2232

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2120

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Modifies data under HKEY_USERS
PID:3040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
PID:5936

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4496

C:\Users\Admin\AppData\Local\Temp\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5136
- C:\Users\Admin\AppData\Local\Temp\s2uy0hz5.agr.exe
  "C:\Users\Admin\AppData\Local\Temp\s2uy0hz5.agr.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4880
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "Mason2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:2456
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4252
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "Mason2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3472
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:592

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:2444

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Suspicious use of SetWindowsHookEx
PID:2756

C:\Users\Admin\AppData\Roaming\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
"C:\Users\Admin\AppData\Roaming\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2596
- C:\Users\Admin\AppData\Local\Temp\4sqtycja.a0f.exe
  "C:\Users\Admin\AppData\Local\Temp\4sqtycja.a0f.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2336
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "Mason2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Roaming\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3524
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:4416
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "Mason2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe" /tr "'C:\Users\Admin\AppData\Roaming\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1984
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:3264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ajh3oozy.1oo.exe

Path C:\Users\Admin\AppData\Local\Temp\ajh3oozy.1oo.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe

Path C:\Users\Admin\AppData\Roaming\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.exe
Size 231KB
SHA256 c4bd1c7bb7eda7d44bfc49d1580cb36ddf862ac7cd123b5ff014915325a42547
MD5 58cc31a8f2c54182147d4a862089c062
SHA1 94cc40b16607eef97dccff28ee6aef8c4bf4c807
SHA512 0f52900f352015a9fdfba7cca77c080d4333cd223e174a08341793296e9be34263d2d1856608c32b52c95de43c8f16322172fb976cf285383e52755df997b4e8
SSDEEP 6144:sx7soh9Z/5bTgVziHzZnSKrCbYMc6bu8tq:s7sw/5/gVziHlBrCbYz80
TLSH
T109343966F6A000FAD4BA42748D636B06B7B2F0360721DBEF1B94495D7F637E04D29B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2026-08-30_58cc31a8f2c54182147d4a862089c062_asyncrat_cobalt-strike_elex_glassworm_icedid_vidar_xworm.lnk
Size 1KB
SHA256 4433aeb8c73b13c8f4b07fbd55ada11fb1513ba036ca26e1c50606404e24ee80
MD5 6dd3af5fbbfa8ef6fc7e3c1e4722c651
SHA1 803cce433d01d9ff894bf091708bd54c6fd41bde
SHA512 776d011e3c66d86cf7a5e6d635ac9e1ea017bd81681f0ab79fa793e658f1cbdde771db8bbcccbc185c80f32b2af57e6d189fddfa5f4de95bcbffb2f38e78b876
TLSH
T1D421A01C5AD21FCBF0FBC57261F5E521E961BCC17A14EA050294534D191AF43AC69F0E
MD5 SHA1 SHA512 TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\catroot2\dberr.txt
Size 63KB
SHA256 9fe52d83b08966fd3bc16c0c951749ae5c5dda359f93271763f83cc0f423d8cc
MD5 9bae22f28b6704b7e103d63105162ae9
SHA1 b9749ce94e271a732ea8400c599e1919901b7b31
SHA512 b7a544182bd550e6423b78e7ad15d3d155c816a89826d1331e7255dedf1464c29f5165ebcc7281bf7efbae5c00327e7260288a72d07d75f8b7d838cb56eb861e
SSDEEP 1536:Zq6gfLjhqzuRskDV7u2a9ZhD1lmD5Dv1PPJ/C7PMV57bUzqShFPXCF3traGFQm7R:ioqH
TLSH
T15A531F0580D8C619C5B60BA273ABEE72D92E65C6770B0DE531AD7301D8C2B552F7A0BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 b948e09ad32b9335bedbbdcb20723f65337413eb515ac72fd09a8c19fc2007bd
MD5 c0a354d281166d42eaf9b455d87df214
SHA1 e733daed9465524e82a890a8e225fa4edea54159
SHA512 1584c5ce85be1dee431dc7658506811a8c8ef44afa1a0ec5b75abee16cad5f4e2e067efa029b55469e2bddd342a57b869dcc5413dbfda1198cd058d18ae9db28
TLSH
T1F0E08C212AF80604E5330A3C6D33A4499A76B677AE41CACD0B75048E0C24FA18D3A61D
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 4830fd2fd59dfca3b23c48e0176fdf5a37153a09cec970c1c6799754fc87d544
MD5 59f8804460b50e77d02bab03ec254a24
SHA1 1fc161336b103a8fe127c57912c5f1c2130f7b1c
SHA512 5b65ed740c839aa3037eb9f5a3e0de3dbaa88ae5e9de3b7c449fe6381da9e2385459952804f682c8673eda7bd6b0d200f7ae93a752f4682b1b42baaba7f27fcf
TLSH
T1EFE0C02411FF502CF1E4C03C87D5642286AEF0310808B2BA1AE017086716D00FC51934
MD5 SHA1 SHA512 TLSH

Submit Download

memory/500-108-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/500-107-0x0000017913C50000-0x0000017913C7B000-memory.dmp

Download

memory/540-104-0x000002514EC90000-0x000002514ECBB000-memory.dmp

Download

memory/540-105-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/736-17-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/736-16-0x000001FA99210000-0x000001FA9923B000-memory.dmp

Download

memory/736-15-0x000001FA991E0000-0x000001FA99205000-memory.dmp

Download

memory/736-282-0x000001FA99210000-0x000001FA9923B000-memory.dmp

Download

memory/736-531-0x000001FA99210000-0x000001FA9923B000-memory.dmp

Download

memory/952-22-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/952-21-0x00000294ADC60000-0x00000294ADC8B000-memory.dmp

Download

memory/952-283-0x00000294ADC60000-0x00000294ADC8B000-memory.dmp

Download

memory/952-532-0x00000294ADC60000-0x00000294ADC8B000-memory.dmp

Download

memory/960-25-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/960-24-0x000001F4A4B30000-0x000001F4A4B5B000-memory.dmp

Download

memory/960-533-0x000001F4A4B30000-0x000001F4A4B5B000-memory.dmp

Download

memory/960-284-0x000001F4A4B30000-0x000001F4A4B5B000-memory.dmp

Download

memory/1088-111-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/1088-110-0x000001EDD4670000-0x000001EDD469B000-memory.dmp

Download

memory/1172-32-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/1172-31-0x0000019DAC300000-0x0000019DAC32B000-memory.dmp

Download

memory/1172-534-0x0000019DAC300000-0x0000019DAC32B000-memory.dmp

Download

memory/1172-285-0x0000019DAC300000-0x0000019DAC32B000-memory.dmp

Download

memory/1224-114-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/1224-113-0x0000022622B80000-0x0000022622BAB000-memory.dmp

Download

memory/1244-115-0x000001C3EEE20000-0x000001C3EEE4B000-memory.dmp

Download

memory/1244-117-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/1304-143-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/1304-142-0x000002A20E750000-0x000002A20E77B000-memory.dmp

Download

memory/1312-120-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/1312-119-0x0000024C5B720000-0x0000024C5B74B000-memory.dmp

Download

memory/1348-122-0x000001DED7500000-0x000001DED752B000-memory.dmp

Download

memory/1348-123-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/1396-146-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/1396-145-0x0000024B22500000-0x0000024B2252B000-memory.dmp

Download

memory/1500-149-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/1500-148-0x000001EAFB8C0000-0x000001EAFB8EB000-memory.dmp

Download

memory/1504-40-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/1504-39-0x000001EAF4BB0000-0x000001EAF4BDB000-memory.dmp

Download

memory/1504-286-0x000001EAF4BB0000-0x000001EAF4BDB000-memory.dmp

Download

memory/1504-535-0x000001EAF4BB0000-0x000001EAF4BDB000-memory.dmp

Download

memory/1512-125-0x0000021784270000-0x000002178429B000-memory.dmp

Download

memory/1592-127-0x000002466FD40000-0x000002466FD6B000-memory.dmp

Download

memory/1592-128-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/1604-130-0x000001BE71F90000-0x000001BE71FBB000-memory.dmp

Download

memory/1604-131-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/1756-133-0x000001FB8CFB0000-0x000001FB8CFDB000-memory.dmp

Download

memory/1756-134-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/1776-136-0x0000020591CC0000-0x0000020591CEB000-memory.dmp

Download

memory/1776-137-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/1892-139-0x0000025BD5120000-0x0000025BD514B000-memory.dmp

Download

memory/1892-140-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/2060-529-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2060-14-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2060-309-0x00000225F3C30000-0x00000225F3C3E000-memory.dmp

Download

memory/2060-530-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2060-2-0x00000225F20B0000-0x00000225F20DC000-memory.dmp

Download

memory/2060-1-0x00007FF8998AF000-0x00007FF8998B0000-memory.dmp

Download

memory/2060-4-0x00007FF899720000-0x00007FF89A0C4000-memory.dmp

Download

memory/2060-699-0x00000225F20F0000-0x00000225F2100000-memory.dmp

Download

memory/2060-0-0x00000225F1C20000-0x00000225F1C60000-memory.dmp

Download

memory/2060-528-0x00000225F20F0000-0x00000225F2100000-memory.dmp

Download

memory/2132-151-0x000001FF4BFC0000-0x000001FF4BFEB000-memory.dmp

Download

memory/2132-152-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/2200-155-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/2200-154-0x000002332AE90000-0x000002332AEBB000-memory.dmp

Download

memory/2296-157-0x00000220F1880000-0x00000220F18AB000-memory.dmp

Download

memory/2296-158-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/2348-160-0x0000020969830000-0x000002096985B000-memory.dmp

Download

memory/2348-162-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/2468-161-0x000001E3F9D70000-0x000001E3F9D9B000-memory.dmp

Download

memory/2468-164-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/2536-167-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/2536-166-0x000001279E500000-0x000001279E52B000-memory.dmp

Download

memory/2556-169-0x0000023122290000-0x00000231222BB000-memory.dmp

Download

memory/2556-170-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/2572-173-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/2572-172-0x00000264B3030000-0x00000264B305B000-memory.dmp

Download

memory/2596-710-0x000001FC466A0000-0x000001FC466E0000-memory.dmp

Download

memory/3484-932-0x0000019C56D60000-0x0000019C56DA0000-memory.dmp

Download

memory/3788-12-0x00007FF8BCAC0000-0x00007FF8BCD23000-memory.dmp

Download

memory/3788-13-0x00007FF8BC8F0000-0x00007FF8BC9B7000-memory.dmp

Download

memory/3872-97-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/3872-537-0x00000000030A0000-0x00000000030CB000-memory.dmp

Download

memory/3872-96-0x00000000030A0000-0x00000000030CB000-memory.dmp

Download

memory/3872-288-0x00000000030A0000-0x00000000030CB000-memory.dmp

Download

memory/4640-82-0x00007FF87CC00000-0x00007FF87CC10000-memory.dmp

Download

memory/4640-536-0x00000217F9E00000-0x00000217F9E2B000-memory.dmp

Download

memory/4640-287-0x00000217F9E00000-0x00000217F9E2B000-memory.dmp

Download

memory/4640-81-0x00000217F9E00000-0x00000217F9E2B000-memory.dmp

Download

memory/5136-318-0x000001782F6A0000-0x000001782F6E0000-memory.dmp

Download

memory/5928-1111-0x00000223ED950000-0x00000223ED990000-memory.dmp

Download