donutloader | cd98f47a7db94c79da4f23f7d996ede38f739515df0e110900b7fb9584c8a16f

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/09/2026, 10:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-24_1627ba78a3c7cd0df06880aa182993db_cobalt-strike_elex_glassworm_icedid_vidar.exe
Size 288KB
Sample260926-memgmadd79
SHA256 cd98f47a7db94c79da4f23f7d996ede38f739515df0e110900b7fb9584c8a16f
MD5 1627ba78a3c7cd0df06880aa182993db
SHA1 705b2dd63d574f326ad9a7180e9d9f5a2c53a447
SHA512 bb0c2109168c696df0f63e279e53c35c7041450e291fb10102dd1d81aaeefbd4242790f75f6143b9708d7fdf927dd2acd19ef0b67f9fe29fc2fcb7ac5f6c61ed
SSDEEP 6144:0YmkxYFiAr5lxFQ/5bTgVziHzZnSKrCbYMjMb78Kq:0YNer5lxK/5/gVziHlBrCbYb8D
TLSH
T183548CA7F6A100FAD4BA41348D635F02B7B2F0361721D7EB0B9449697F637A05D29F90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery donutloader neptunerat loader privilege_escalation trojan

Malware Config

Extracted

Family

neptunerat

ita19cpssssss-36719.portmap.host:36719

Attributes

filename
USB.exe
group
MasonGroup
key
MyYrDB0EL0IoZ3FZ
rat_name
MasonRAT

Signatures

Family: DonutLoader
DonutLoader is a position-independent code that enables in-memory execution of VBScript, JScript, EXE, DLL files and dotNET assemblies.
loader donutloader
Family: NeptuneRAT, MasonRAT
NeptuneRAT aka MasonRAT is a trojan written in C#.
trojan neptunerat

Detects DonutLoader 1 IoCs

loader

resource	yara_rule
behavioral2/memory/4320-12-0x0000015A23AF0000-0x0000015A23B06000-memory.dmp	family_donutloader

Detects NeptuneRAT stealer 1 IoCs

resource	yara_rule
behavioral2/memory/4320-31-0x0000015A23C60000-0x0000015A23C74000-memory.dmp	family_neptunerat

Detects Windows exceutables bypassing UAC using CMSTP utility, command line and INF 1 IoCs

resource	yara_rule
behavioral2/memory/4320-31-0x0000015A23C60000-0x0000015A23C74000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_UACBypass_CMSTPCMD

Detects Windows executables referencing non-Windows User-Agents 1 IoCs

resource	yara_rule
behavioral2/memory/4320-31-0x0000015A23C60000-0x0000015A23C74000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Executes dropped EXE 1 IoCs

pid	Process
1248	5pwso3nk.tdg.exe

Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs

Clear Windows Event Logs to hide the activity of an intrusion.

defense_evasion

Clear Windows Event Logs

T1070.001

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-WER-Diag%4Operational.evtx	svchost.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ip-api.com

Drops file in System32 directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-09-24_1627ba78a3c7cd0df06880aa182993db_cobalt-strike_elex_glassworm_icedid_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-09-24_1627ba78a3c7cd0df06880aa182993db_cobalt-strike_elex_glassworm_icedid_vidar.exe

Modifies data under HKEY_USERS 56 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={C98D5C3B-5DBC-4580-8327-91D8507AE867}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Thu, 24 Sep 2026 15:13:21 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1790418190"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\ExtendedProperties\LID = "00188019C7AE1F28"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\NotificationData	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe
1248	5pwso3nk.tdg.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1720	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4320	2026-09-24_1627ba78a3c7cd0df06880aa182993db_cobalt-strike_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	1248	5pwso3nk.tdg.exe
Token: SeDebugPrivilege	4320	2026-09-24_1627ba78a3c7cd0df06880aa182993db_cobalt-strike_elex_glassworm_icedid_vidar.exe
Token: SeAssignPrimaryTokenPrivilege	3672	svchost.exe
Token: SeIncreaseQuotaPrivilege	3672	svchost.exe
Token: SeSecurityPrivilege	3672	svchost.exe
Token: SeTakeOwnershipPrivilege	3672	svchost.exe
Token: SeLoadDriverPrivilege	3672	svchost.exe
Token: SeSystemtimePrivilege	3672	svchost.exe
Token: SeBackupPrivilege	3672	svchost.exe
Token: SeRestorePrivilege	3672	svchost.exe
Token: SeShutdownPrivilege	3672	svchost.exe
Token: SeSystemEnvironmentPrivilege	3672	svchost.exe
Token: SeUndockPrivilege	3672	svchost.exe
Token: SeManageVolumePrivilege	3672	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3672	svchost.exe
Token: SeIncreaseQuotaPrivilege	3672	svchost.exe
Token: SeSecurityPrivilege	3672	svchost.exe
Token: SeTakeOwnershipPrivilege	3672	svchost.exe
Token: SeLoadDriverPrivilege	3672	svchost.exe
Token: SeSystemtimePrivilege	3672	svchost.exe
Token: SeBackupPrivilege	3672	svchost.exe
Token: SeRestorePrivilege	3672	svchost.exe
Token: SeShutdownPrivilege	3672	svchost.exe
Token: SeSystemEnvironmentPrivilege	3672	svchost.exe
Token: SeUndockPrivilege	3672	svchost.exe
Token: SeManageVolumePrivilege	3672	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3672	svchost.exe
Token: SeIncreaseQuotaPrivilege	3672	svchost.exe
Token: SeSecurityPrivilege	3672	svchost.exe
Token: SeTakeOwnershipPrivilege	3672	svchost.exe
Token: SeLoadDriverPrivilege	3672	svchost.exe
Token: SeSystemtimePrivilege	3672	svchost.exe
Token: SeBackupPrivilege	3672	svchost.exe
Token: SeRestorePrivilege	3672	svchost.exe
Token: SeShutdownPrivilege	3672	svchost.exe
Token: SeSystemEnvironmentPrivilege	3672	svchost.exe
Token: SeUndockPrivilege	3672	svchost.exe
Token: SeManageVolumePrivilege	3672	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3672	svchost.exe
Token: SeIncreaseQuotaPrivilege	3672	svchost.exe
Token: SeSecurityPrivilege	3672	svchost.exe
Token: SeTakeOwnershipPrivilege	3672	svchost.exe
Token: SeLoadDriverPrivilege	3672	svchost.exe
Token: SeSystemtimePrivilege	3672	svchost.exe
Token: SeBackupPrivilege	3672	svchost.exe
Token: SeRestorePrivilege	3672	svchost.exe
Token: SeShutdownPrivilege	3672	svchost.exe
Token: SeSystemEnvironmentPrivilege	3672	svchost.exe
Token: SeUndockPrivilege	3672	svchost.exe
Token: SeManageVolumePrivilege	3672	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3672	svchost.exe
Token: SeIncreaseQuotaPrivilege	3672	svchost.exe
Token: SeSecurityPrivilege	3672	svchost.exe
Token: SeTakeOwnershipPrivilege	3672	svchost.exe
Token: SeLoadDriverPrivilege	3672	svchost.exe
Token: SeSystemtimePrivilege	3672	svchost.exe
Token: SeBackupPrivilege	3672	svchost.exe
Token: SeRestorePrivilege	3672	svchost.exe
Token: SeShutdownPrivilege	3672	svchost.exe
Token: SeSystemEnvironmentPrivilege	3672	svchost.exe
Token: SeUndockPrivilege	3672	svchost.exe
Token: SeManageVolumePrivilege	3672	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3672	svchost.exe

Suspicious use of UnmapMainImage 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Hollowing

T1055.012

pid	Process
1720	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 1248	4320	2026-09-24_1627ba78a3c7cd0df06880aa182993db_cobalt-strike_elex_glassworm_icedid_vidar.exe	89
PID 1248 wrote to memory of 744	1248	5pwso3nk.tdg.exe	5
PID 1248 wrote to memory of 964	1248	5pwso3nk.tdg.exe	9
PID 1248 wrote to memory of 972	1248	5pwso3nk.tdg.exe	10
PID 1248 wrote to memory of 988	1248	5pwso3nk.tdg.exe	11
PID 1248 wrote to memory of 1028	1248	5pwso3nk.tdg.exe	13
PID 1248 wrote to memory of 1120	1248	5pwso3nk.tdg.exe	14
PID 1248 wrote to memory of 1180	1248	5pwso3nk.tdg.exe	15
PID 1248 wrote to memory of 1240	1248	5pwso3nk.tdg.exe	16
PID 1248 wrote to memory of 1260	1248	5pwso3nk.tdg.exe	17
PID 1248 wrote to memory of 1360	1248	5pwso3nk.tdg.exe	18
PID 1248 wrote to memory of 1392	1248	5pwso3nk.tdg.exe	19
PID 1248 wrote to memory of 1648	1248	5pwso3nk.tdg.exe	22
PID 1248 wrote to memory of 1656	1248	5pwso3nk.tdg.exe	23
PID 1248 wrote to memory of 1664	1248	5pwso3nk.tdg.exe	24
PID 1248 wrote to memory of 1676	1248	5pwso3nk.tdg.exe	25
PID 1248 wrote to memory of 1700	1248	5pwso3nk.tdg.exe	26
PID 1248 wrote to memory of 1840	1248	5pwso3nk.tdg.exe	27
PID 1248 wrote to memory of 1924	1248	5pwso3nk.tdg.exe	28
PID 1248 wrote to memory of 1068	1248	5pwso3nk.tdg.exe	29
PID 1248 wrote to memory of 716	1248	5pwso3nk.tdg.exe	30
PID 1248 wrote to memory of 2056	1248	5pwso3nk.tdg.exe	31
PID 1248 wrote to memory of 2120	1248	5pwso3nk.tdg.exe	32
PID 1248 wrote to memory of 2200	1248	5pwso3nk.tdg.exe	33
PID 1248 wrote to memory of 2284	1248	5pwso3nk.tdg.exe	34
PID 1248 wrote to memory of 2344	1248	5pwso3nk.tdg.exe	35
PID 1248 wrote to memory of 2428	1248	5pwso3nk.tdg.exe	36
PID 1248 wrote to memory of 2512	1248	5pwso3nk.tdg.exe	37
PID 1248 wrote to memory of 2520	1248	5pwso3nk.tdg.exe	38
PID 1248 wrote to memory of 2632	1248	5pwso3nk.tdg.exe	39
PID 1248 wrote to memory of 2756	1248	5pwso3nk.tdg.exe	40
PID 1248 wrote to memory of 2772	1248	5pwso3nk.tdg.exe	41
PID 1248 wrote to memory of 2852	1248	5pwso3nk.tdg.exe	42
PID 1248 wrote to memory of 2988	1248	5pwso3nk.tdg.exe	43
PID 1248 wrote to memory of 1416	1248	5pwso3nk.tdg.exe	44
PID 1248 wrote to memory of 3100	1248	5pwso3nk.tdg.exe	45
PID 1248 wrote to memory of 3164	1248	5pwso3nk.tdg.exe	47
PID 1248 wrote to memory of 3244	1248	5pwso3nk.tdg.exe	48
PID 1248 wrote to memory of 3504	1248	5pwso3nk.tdg.exe	50
PID 1248 wrote to memory of 3584	1248	5pwso3nk.tdg.exe	51
PID 1248 wrote to memory of 3612	1248	5pwso3nk.tdg.exe	52
PID 1248 wrote to memory of 3656	1248	5pwso3nk.tdg.exe	53
PID 1248 wrote to memory of 3664	1248	5pwso3nk.tdg.exe	54
PID 1248 wrote to memory of 3672	1248	5pwso3nk.tdg.exe	55
PID 1248 wrote to memory of 3708	1248	5pwso3nk.tdg.exe	56
PID 1248 wrote to memory of 824	1248	5pwso3nk.tdg.exe	57
PID 1248 wrote to memory of 3684	1248	5pwso3nk.tdg.exe	58
PID 1248 wrote to memory of 4452	1248	5pwso3nk.tdg.exe	59
PID 1248 wrote to memory of 4496	1248	5pwso3nk.tdg.exe	60
PID 1248 wrote to memory of 4548	1248	5pwso3nk.tdg.exe	61
PID 1248 wrote to memory of 4760	1248	5pwso3nk.tdg.exe	62
PID 1248 wrote to memory of 4800	1248	5pwso3nk.tdg.exe	63
PID 1248 wrote to memory of 4420	1248	5pwso3nk.tdg.exe	64
PID 1248 wrote to memory of 5124	1248	5pwso3nk.tdg.exe	65
PID 1248 wrote to memory of 5192	1248	5pwso3nk.tdg.exe	66
PID 1248 wrote to memory of 5228	1248	5pwso3nk.tdg.exe	67
PID 1248 wrote to memory of 5576	1248	5pwso3nk.tdg.exe	70
PID 1248 wrote to memory of 1304	1248	5pwso3nk.tdg.exe	73
PID 1248 wrote to memory of 3156	1248	5pwso3nk.tdg.exe	74
PID 1248 wrote to memory of 2492	1248	5pwso3nk.tdg.exe	75
PID 1248 wrote to memory of 3864	1248	5pwso3nk.tdg.exe	78
PID 1248 wrote to memory of 1480	1248	5pwso3nk.tdg.exe	79
PID 1248 wrote to memory of 4000	1248	5pwso3nk.tdg.exe	80
PID 1248 wrote to memory of 3736	1248	5pwso3nk.tdg.exe	81

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:744
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:972
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1180

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:964

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-98645ba9-449c-4dd9-a482-e4564f75023b -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-31601a4d-d9f6-452e-8631-61c8998cc532 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-6655709f-8b3f-4257-8e87-b332973b2d6a -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e9263510-724e-440e-bb92-6d036a4272b4 -LifetimeId:d3c99f66-07d1-4dcb-ae73-1fdba904d434 -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1120

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1840

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1924
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:3736
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of UnmapMainImage
    PID:1720
  - - C:\Users\Admin\AppData\Local\Temp\2026-09-24_1627ba78a3c7cd0df06880aa182993db_cobalt-strike_elex_glassworm_icedid_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-09-24_1627ba78a3c7cd0df06880aa182993db_cobalt-strike_elex_glassworm_icedid_vidar.exe"
      4⤵
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4320
    - - C:\Users\Admin\AppData\Local\Temp\5pwso3nk.tdg.exe
        
        "C:\Users\Admin\AppData\Local\Temp\5pwso3nk.tdg.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1248

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Indicator Removal: Clear Windows Event Logs
PID:1068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:716

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2056

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2120

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2200

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2344

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2512
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:000000000000026C;0000000000000270;
  2⤵
  PID:4420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2520

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2632

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2772

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2988

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3244

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:3684

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4452

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4760

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4800

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5124

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5192

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5576

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:1304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3156

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:2492

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:3864

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:4000

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:5384

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Process Injection

T1055

Process Hollowing

T1055.012

Defense Evasion

Indicator Removal

T1070

Clear Windows Event Logs

T1070.001

Process Injection

T1055

Process Hollowing

T1055.012

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5pwso3nk.tdg.exe

Path C:\Users\Admin\AppData\Local\Temp\5pwso3nk.tdg.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 e59e2539bff1fd1b38b41826283c2f5cb40c6311e44b74568866747c08f87a23
MD5 b8dd9520616b200a51623a899db69fc9
SHA1 11c58ed2814e6d0af41ccb7d952b566a47fdf59d
SHA512 6f8bef7e84dd27a7269cad187feb1292be79b7fe48defcd7cb384687c2413aa93a0e1ab2c5ab858a5b1a2a7989dca374b40849fd00d7bf9f6ba56f143b13e8ef
TLSH
T14EE086517FA80504E5730A3C69736448993676369E01C69D0775418D1C25F91CD7671A
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 d9e635adcbf57308aaf038f0b3bf4bff84e49f02b8d35c880c986477c774800a
MD5 37606639ca0953f33b3ee5222f500127
SHA1 1a4a5ca9773304280bb1b637a9584572b6709ab3
SHA512 73654a66bfdcd6649072518b9baa560f03870a1ec499aaed75692982630e3561e437627cb3ac77a5ec417faf68aaa39a6cb6939e620b94dac8ad29ca3cdca2a4
TLSH
T19EE0C01416FB911CF5F4D4348BE5A431459DF0200419B2B92ED06704B30A940EC42974
MD5 SHA1 SHA512 TLSH

Submit Download

memory/716-151-0x000001D474920000-0x000001D47494B000-memory.dmp

Download

memory/716-153-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/744-20-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/744-286-0x000001A768560000-0x000001A76858B000-memory.dmp

Download

memory/744-19-0x000001A768560000-0x000001A76858B000-memory.dmp

Download

memory/744-18-0x000001A768530000-0x000001A768555000-memory.dmp

Download

memory/964-24-0x000001B813BC0000-0x000001B813BEB000-memory.dmp

Download

memory/964-287-0x000001B813BC0000-0x000001B813BEB000-memory.dmp

Download

memory/964-25-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/972-293-0x00000271ADC90000-0x00000271ADCBB000-memory.dmp

Download

memory/972-28-0x00000271ADC90000-0x00000271ADCBB000-memory.dmp

Download

memory/972-29-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/988-110-0x000001A7EB1A0000-0x000001A7EB1CB000-memory.dmp

Download

memory/988-111-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/1028-114-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/1028-113-0x0000023B8E370000-0x0000023B8E39B000-memory.dmp

Download

memory/1068-149-0x0000023489760000-0x000002348978B000-memory.dmp

Download

memory/1068-150-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/1120-116-0x0000020FC7860000-0x0000020FC788B000-memory.dmp

Download

memory/1120-117-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/1180-38-0x000001EA24F50000-0x000001EA24F7B000-memory.dmp

Download

memory/1180-290-0x000001EA24F50000-0x000001EA24F7B000-memory.dmp

Download

memory/1180-39-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/1240-119-0x000001DA22030000-0x000001DA2205B000-memory.dmp

Download

memory/1240-120-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/1248-16-0x00007FFEF7230000-0x00007FFEF72F7000-memory.dmp

Download

memory/1248-15-0x00007FFEF8460000-0x00007FFEF86C3000-memory.dmp

Download

memory/1260-123-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/1260-122-0x000001F8FEE70000-0x000001F8FEE9B000-memory.dmp

Download

memory/1360-126-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/1360-125-0x0000020766AC0000-0x0000020766AEB000-memory.dmp

Download

memory/1392-129-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/1392-128-0x000002E086C90000-0x000002E086CBB000-memory.dmp

Download

memory/1648-131-0x0000017039FD0000-0x0000017039FFB000-memory.dmp

Download

memory/1648-132-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/1656-135-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/1656-134-0x00000217F8670000-0x00000217F869B000-memory.dmp

Download

memory/1664-137-0x000001CEE68C0000-0x000001CEE68EB000-memory.dmp

Download

memory/1664-138-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/1676-141-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/1676-140-0x0000022D0EC50000-0x0000022D0EC7B000-memory.dmp

Download

memory/1700-291-0x000002EFB9800000-0x000002EFB982B000-memory.dmp

Download

memory/1700-51-0x000002EFB9800000-0x000002EFB982B000-memory.dmp

Download

memory/1700-52-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/1720-105-0x0000000000950000-0x000000000097B000-memory.dmp

Download

memory/1720-106-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/1840-144-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/1840-143-0x000001FD74B00000-0x000001FD74B2B000-memory.dmp

Download

memory/1924-146-0x0000028F7D9F0000-0x0000028F7DA1B000-memory.dmp

Download

memory/1924-147-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/2056-155-0x00000223CACB0000-0x00000223CACDB000-memory.dmp

Download

memory/2056-156-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/2120-158-0x000001B8ACE60000-0x000001B8ACE8B000-memory.dmp

Download

memory/2120-159-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/2200-162-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/2200-161-0x0000023143E90000-0x0000023143EBB000-memory.dmp

Download

memory/2284-164-0x0000024E7B7D0000-0x0000024E7B7FB000-memory.dmp

Download

memory/2284-165-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/2344-169-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/2344-167-0x0000021E03C90000-0x0000021E03CBB000-memory.dmp

Download

memory/2428-170-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/2428-168-0x000001E5399E0000-0x000001E539A0B000-memory.dmp

Download

memory/2512-174-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/2512-173-0x000001F3BDC50000-0x000001F3BDC7B000-memory.dmp

Download

memory/2520-177-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/2520-176-0x000002208BC00000-0x000002208BC2B000-memory.dmp

Download

memory/4320-303-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4320-32-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4320-17-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4320-27-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4320-31-0x0000015A23C60000-0x0000015A23C74000-memory.dmp

Download

memory/4320-0-0x00007FFED58CF000-0x00007FFED58D0000-memory.dmp

Download

memory/4320-41-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4320-1-0x0000015A21CF0000-0x0000015A21D3E000-memory.dmp

Download

memory/4320-33-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4320-2-0x0000015A22190000-0x0000015A221BC000-memory.dmp

Download

memory/4320-288-0x0000015A3C580000-0x0000015A3C590000-memory.dmp

Download

memory/4320-289-0x0000015A3C580000-0x0000015A3C590000-memory.dmp

Download

memory/4320-182-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4320-12-0x0000015A23AF0000-0x0000015A23B06000-memory.dmp

Download

memory/4320-11-0x0000015A23AD0000-0x0000015A23AEC000-memory.dmp

Download

memory/4320-4-0x00007FFED5740000-0x00007FFED60E4000-memory.dmp

Download

memory/4420-91-0x00007FFEB85A0000-0x00007FFEB85B0000-memory.dmp

Download

memory/4420-90-0x000001C5710E0000-0x000001C57110B000-memory.dmp

Download

memory/4420-292-0x000001C5710E0000-0x000001C57110B000-memory.dmp

Download