xworm | dbaac58137193f9961d52ecef1a3f2a57c780e7dcf8f5d81fe9d59c75f0ec61b

Analysis

max time kernel
85s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe
Size 389KB
Sample261024-nn71cstycz
SHA256 dbaac58137193f9961d52ecef1a3f2a57c780e7dcf8f5d81fe9d59c75f0ec61b
MD5 5f527ec857da66cc62339f6ecfb0ba5b
SHA1 294ba1eff9a10b8d1159f2a703f528ce60e54c09
SHA512 03ccd3233d3fe003b1e0cbe81ba28a90830c7a8efb285a15e02cd85a747d9cbc6afeefcb871863aea7827a1196393bac22192ff44b5e7caf28c2e0b212ecd9d7
SSDEEP 6144:5bM5DZqP5h0Kb3Zhbo/5bTgVziHzZnSKrCbYMx+tb68pLq:5Nhh0K4/5/gVziHlBrCbYu8Y
TLSH
T1C4846C5AF69040EAD4A941328C635B0567B2FC361722E7EF1AD43D9D7F337A04D2AB90
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xworm persistence privilege_escalation rat trojan

Malware Config

Extracted

Family

xworm

Version

Attributes

install_file
Mason.exe

Signatures

Family: Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Detect Xworm Payload 4 IoCs

resource	yara_rule
behavioral2/memory/4976-0-0x00000244F5580000-0x00000244F55E8000-memory.dmp	family_xworm
behavioral2/memory/2064-325-0x0000013AC9770000-0x0000013AC97D8000-memory.dmp	family_xworm
behavioral2/memory/4976-491-0x00000244F7F60000-0x00000244F7F7C000-memory.dmp	family_xworm
behavioral2/files/0x000b0000000170ef-639.dat	family_xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5876	powershell.exe
1400	powershell.exe
2816	powershell.exe
352	powershell.exe

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mason.lnk	2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mason.lnk	2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe

Executes dropped EXE 6 IoCs

pid	Process
5140	xpblenbm.in2.exe
1184	hcc2v4mz.3ap.exe
4248	mason.exe
3300	fe3p51o3.p5d.exe
3648	mason.exe
1384	1j1yek0d.jmq.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\mason = "C:\\Users\\Admin\\AppData\\Roaming\\mason.exe"	2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe

Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
1	pastebin.com
7	pastebin.com

Drops file in System32 directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\mason	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_879AFEB08DCB012707582D902977FF92	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Mason2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Masonmason.exe	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B76BE66D46C355931939D8CF818D03FD_39DF7432E6EF50CDA9C936E29E7DA30D	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe

Modifies data under HKEY_USERS 54 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Thu, 22 Oct 2026 02:20:56 GMT"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,940 10,941 10,942 10,943 10,940 15,1329 15,940 6,944 50,944 10,941 15,942 15,940 50,943 15,944 6,944 15,943 6,1329 50,1329 100,1329 6,941 6,942 6,944 100,940 100"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={C98D5C3B-5DBC-4580-8327-91D8507AE867}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "17110992,504928405,41816131,507286179,7202265,17110988,7153487,504928410,577889346,5804129,17962391,508368333,17962392,41484365,24262478,9179409,3462423,3702920,3700754,3965062,24262474,4297094,7153421,3462365,18716193,7153435,24262477,25036127,24262473,9179410,20502174,6308191,18407617,39125643,539756558,6104718,9179411,51475283,41185282,39389248,539756557,528570079,7202269"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1792841638"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	svchost.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\NotificationData	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\NotificationData\0D83063EA3B8FCF5 = 0100000000000002	explorer.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 11 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2376	SCHTASKS.exe
3724	SCHTASKS.exe
1456	SCHTASKS.exe
3976	SCHTASKS.exe
6116	schtasks.exe
2356	SCHTASKS.exe
6116	SCHTASKS.exe
896	SCHTASKS.exe
4176	SCHTASKS.exe
3456	SCHTASKS.exe
4640	SCHTASKS.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
5140	xpblenbm.in2.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
5876	powershell.exe
5876	powershell.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
5876	powershell.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe
1184	hcc2v4mz.3ap.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3480	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4976	2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	5140	xpblenbm.in2.exe
Token: SeShutdownPrivilege	3480	explorer.exe
Token: SeCreatePagefilePrivilege	3480	explorer.exe
Token: SeShutdownPrivilege	3480	explorer.exe
Token: SeCreatePagefilePrivilege	3480	explorer.exe
Token: SeDebugPrivilege	2064	2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe
Token: SeDebugPrivilege	1184	hcc2v4mz.3ap.exe
Token: SeDebugPrivilege	5876	powershell.exe
Token: SeIncreaseQuotaPrivilege	5876	powershell.exe
Token: SeSecurityPrivilege	5876	powershell.exe
Token: SeTakeOwnershipPrivilege	5876	powershell.exe
Token: SeLoadDriverPrivilege	5876	powershell.exe
Token: SeSystemProfilePrivilege	5876	powershell.exe
Token: SeSystemtimePrivilege	5876	powershell.exe
Token: SeProfSingleProcessPrivilege	5876	powershell.exe
Token: SeIncBasePriorityPrivilege	5876	powershell.exe
Token: SeCreatePagefilePrivilege	5876	powershell.exe
Token: SeBackupPrivilege	5876	powershell.exe
Token: SeRestorePrivilege	5876	powershell.exe
Token: SeShutdownPrivilege	5876	powershell.exe
Token: SeDebugPrivilege	5876	powershell.exe
Token: SeSystemEnvironmentPrivilege	5876	powershell.exe
Token: SeRemoteShutdownPrivilege	5876	powershell.exe
Token: SeUndockPrivilege	5876	powershell.exe
Token: SeManageVolumePrivilege	5876	powershell.exe
Token: 33	5876	powershell.exe
Token: 34	5876	powershell.exe
Token: 35	5876	powershell.exe
Token: 36	5876	powershell.exe
Token: SeAssignPrimaryTokenPrivilege	3640	svchost.exe
Token: SeIncreaseQuotaPrivilege	3640	svchost.exe
Token: SeSecurityPrivilege	3640	svchost.exe
Token: SeTakeOwnershipPrivilege	3640	svchost.exe
Token: SeLoadDriverPrivilege	3640	svchost.exe
Token: SeSystemtimePrivilege	3640	svchost.exe
Token: SeBackupPrivilege	3640	svchost.exe
Token: SeRestorePrivilege	3640	svchost.exe
Token: SeShutdownPrivilege	3640	svchost.exe
Token: SeSystemEnvironmentPrivilege	3640	svchost.exe
Token: SeUndockPrivilege	3640	svchost.exe
Token: SeManageVolumePrivilege	3640	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3640	svchost.exe
Token: SeIncreaseQuotaPrivilege	3640	svchost.exe
Token: SeSecurityPrivilege	3640	svchost.exe
Token: SeTakeOwnershipPrivilege	3640	svchost.exe
Token: SeLoadDriverPrivilege	3640	svchost.exe
Token: SeSystemtimePrivilege	3640	svchost.exe
Token: SeBackupPrivilege	3640	svchost.exe
Token: SeRestorePrivilege	3640	svchost.exe
Token: SeShutdownPrivilege	3640	svchost.exe
Token: SeSystemEnvironmentPrivilege	3640	svchost.exe
Token: SeUndockPrivilege	3640	svchost.exe
Token: SeManageVolumePrivilege	3640	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	3640	svchost.exe
Token: SeIncreaseQuotaPrivilege	3640	svchost.exe
Token: SeSecurityPrivilege	3640	svchost.exe
Token: SeTakeOwnershipPrivilege	3640	svchost.exe
Token: SeLoadDriverPrivilege	3640	svchost.exe
Token: SeSystemtimePrivilege	3640	svchost.exe
Token: SeBackupPrivilege	3640	svchost.exe
Token: SeRestorePrivilege	3640	svchost.exe
Token: SeShutdownPrivilege	3640	svchost.exe
Token: SeSystemEnvironmentPrivilege	3640	svchost.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2400	Conhost.exe
4688	Conhost.exe

Suspicious use of UnmapMainImage 1 TTPs 1 IoCs

defense_evasion privilege_escalation

Process Hollowing

T1055.012

pid	Process
3480	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4976 wrote to memory of 5140	4976	2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe	88
PID 4976 wrote to memory of 3724	4976	2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe	89
PID 5140 wrote to memory of 756	5140	xpblenbm.in2.exe	5
PID 5140 wrote to memory of 972	5140	xpblenbm.in2.exe	9
PID 5140 wrote to memory of 980	5140	xpblenbm.in2.exe	10
PID 5140 wrote to memory of 496	5140	xpblenbm.in2.exe	11
PID 5140 wrote to memory of 1044	5140	xpblenbm.in2.exe	13
PID 5140 wrote to memory of 1132	5140	xpblenbm.in2.exe	15
PID 5140 wrote to memory of 1176	5140	xpblenbm.in2.exe	16
PID 5140 wrote to memory of 1244	5140	xpblenbm.in2.exe	17
PID 5140 wrote to memory of 1300	5140	xpblenbm.in2.exe	18
PID 5140 wrote to memory of 1360	5140	xpblenbm.in2.exe	19
PID 5140 wrote to memory of 1528	5140	xpblenbm.in2.exe	22
PID 5140 wrote to memory of 1596	5140	xpblenbm.in2.exe	23
PID 5140 wrote to memory of 1688	5140	xpblenbm.in2.exe	24
PID 5140 wrote to memory of 1696	5140	xpblenbm.in2.exe	25
PID 5140 wrote to memory of 1708	5140	xpblenbm.in2.exe	26
PID 5140 wrote to memory of 1716	5140	xpblenbm.in2.exe	27
PID 5140 wrote to memory of 1972	5140	xpblenbm.in2.exe	28
PID 5140 wrote to memory of 2040	5140	xpblenbm.in2.exe	29
PID 5140 wrote to memory of 2088	5140	xpblenbm.in2.exe	30
PID 5140 wrote to memory of 2112	5140	xpblenbm.in2.exe	31
PID 5140 wrote to memory of 2136	5140	xpblenbm.in2.exe	32
PID 5140 wrote to memory of 2260	5140	xpblenbm.in2.exe	33
PID 5140 wrote to memory of 2340	5140	xpblenbm.in2.exe	34
PID 5140 wrote to memory of 2360	5140	xpblenbm.in2.exe	35
PID 5140 wrote to memory of 2484	5140	xpblenbm.in2.exe	36
PID 5140 wrote to memory of 2536	5140	xpblenbm.in2.exe	37
PID 5140 wrote to memory of 2604	5140	xpblenbm.in2.exe	38
PID 5140 wrote to memory of 2672	5140	xpblenbm.in2.exe	39
PID 5140 wrote to memory of 2700	5140	xpblenbm.in2.exe	40
PID 5140 wrote to memory of 2752	5140	xpblenbm.in2.exe	41
PID 5140 wrote to memory of 2864	5140	xpblenbm.in2.exe	42
PID 5140 wrote to memory of 2936	5140	xpblenbm.in2.exe	43
PID 5140 wrote to memory of 2328	5140	xpblenbm.in2.exe	44
PID 5140 wrote to memory of 3136	5140	xpblenbm.in2.exe	46
PID 5140 wrote to memory of 3184	5140	xpblenbm.in2.exe	47
PID 5140 wrote to memory of 3264	5140	xpblenbm.in2.exe	48
PID 5140 wrote to memory of 3492	5140	xpblenbm.in2.exe	50
PID 5140 wrote to memory of 3552	5140	xpblenbm.in2.exe	51
PID 5140 wrote to memory of 3564	5140	xpblenbm.in2.exe	52
PID 5140 wrote to memory of 3612	5140	xpblenbm.in2.exe	53
PID 5140 wrote to memory of 3640	5140	xpblenbm.in2.exe	54
PID 5140 wrote to memory of 3652	5140	xpblenbm.in2.exe	55
PID 5140 wrote to memory of 3672	5140	xpblenbm.in2.exe	56
PID 5140 wrote to memory of 924	5140	xpblenbm.in2.exe	57
PID 5140 wrote to memory of 1108	5140	xpblenbm.in2.exe	58
PID 5140 wrote to memory of 4416	5140	xpblenbm.in2.exe	59
PID 5140 wrote to memory of 4448	5140	xpblenbm.in2.exe	60
PID 5140 wrote to memory of 4492	5140	xpblenbm.in2.exe	61
PID 5140 wrote to memory of 4716	5140	xpblenbm.in2.exe	62
PID 5140 wrote to memory of 4832	5140	xpblenbm.in2.exe	63
PID 5140 wrote to memory of 4240	5140	xpblenbm.in2.exe	64
PID 5140 wrote to memory of 5168	5140	xpblenbm.in2.exe	65
PID 5140 wrote to memory of 5232	5140	xpblenbm.in2.exe	66
PID 5140 wrote to memory of 5272	5140	xpblenbm.in2.exe	67
PID 5140 wrote to memory of 5680	5140	xpblenbm.in2.exe	70
PID 5140 wrote to memory of 1480	5140	xpblenbm.in2.exe	72
PID 5140 wrote to memory of 4424	5140	xpblenbm.in2.exe	74
PID 5140 wrote to memory of 5296	5140	xpblenbm.in2.exe	75
PID 5140 wrote to memory of 768	5140	xpblenbm.in2.exe	77
PID 5140 wrote to memory of 5116	5140	xpblenbm.in2.exe	78
PID 5140 wrote to memory of 5936	5140	xpblenbm.in2.exe	79
PID 5140 wrote to memory of 5572	5140	xpblenbm.in2.exe	80

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:756
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:972
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1176

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:980

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-ec8eca41-131f-4b3f-b5cf-b443095b4e14 -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-e0f3a590-8e20-4947-a662-c464179663cc -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-894bd0ee-5fed-40e0-adc2-1451205c988d -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-d5f2fb7b-671d-4e19-84ad-01083afdc513 -LifetimeId:ee9acc8d-3bf0-4bce-904d-f7ffe3fe0efc -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:496

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1132

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1300

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1528

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1596

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netprofm -p -s netprofm
1⤵
PID:1688

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1696
- C:\Users\Admin\AppData\Roaming\mason.exe
  "C:\Users\Admin\AppData\Roaming\mason.exe"
  2⤵
  - Executes dropped EXE
  PID:4248
- - C:\Users\Admin\AppData\Local\Temp\fe3p51o3.p5d.exe
    "C:\Users\Admin\AppData\Local\Temp\fe3p51o3.p5d.exe"
    3⤵
    - Executes dropped EXE
    PID:3300
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonmason.exe" /tr "'C:\Users\Admin\AppData\Roaming\mason.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4176
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonmason.exe" /tr "'C:\Users\Admin\AppData\Roaming\mason.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3456
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:6108
- C:\Users\Admin\AppData\Roaming\mason.exe
  "C:\Users\Admin\AppData\Roaming\mason.exe"
  2⤵
  - Executes dropped EXE
  PID:3648
- - C:\Users\Admin\AppData\Local\Temp\1j1yek0d.jmq.exe
    "C:\Users\Admin\AppData\Local\Temp\1j1yek0d.jmq.exe"
    3⤵
    - Executes dropped EXE
    PID:1384
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonmason.exe" /tr "'C:\Users\Admin\AppData\Roaming\mason.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4640
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5240
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonmason.exe" /tr "'C:\Users\Admin\AppData\Roaming\mason.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2356
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:5692
- C:\Users\Admin\AppData\Roaming\mason.exe
  "C:\Users\Admin\AppData\Roaming\mason.exe"
  2⤵
  PID:1000
- - C:\Users\Admin\AppData\Local\Temp\veywodqb.yrk.exe
    "C:\Users\Admin\AppData\Local\Temp\veywodqb.yrk.exe"
    3⤵
    PID:5604
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonmason.exe" /tr "'C:\Users\Admin\AppData\Roaming\mason.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6116
- - C:\Windows\system32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "Masonmason.exe" /tr "'C:\Users\Admin\AppData\Roaming\mason.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2376

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UserProfileService -p -s ProfSvc
1⤵
PID:1708

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1716

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1972
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5572
- - C:\Windows\explorer.exe
    explorer.exe /LOADSAVEDWINDOWS
    3⤵
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of UnmapMainImage
    PID:3480
  - - C:\Users\Admin\AppData\Local\Temp\2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe
      "C:\Users\Admin\AppData\Local\Temp\2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe"
      4⤵
      Creates a file in the Startup directory
      Adds Run key to start application
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\xpblenbm.in2.exe
        
        "C:\Users\Admin\AppData\Local\Temp\xpblenbm.in2.exe"
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:5140
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Mason2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:3724
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:4792
    - - C:\Windows\SYSTEM32\SCHTASKS.exe
        
        "SCHTASKS.exe" /create /tn "Mason2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe'" /sc onlogon /rl HIGHEST
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:896
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5348
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5876
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2400
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess '2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:1400
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2724
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\mason.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:2816
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5916
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'mason.exe'
        5⤵
        Command and Scripting Interpreter: PowerShell
        
        PID:352
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:4688
    - - C:\Windows\System32\schtasks.exe
        
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "mason" /tr "C:\Users\Admin\AppData\Roaming\mason.exe"
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:6116
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:2896

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:2040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p
1⤵
PID:2088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:2112

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:2136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:2260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:2360

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:2484

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TextInputManagementService
1⤵
PID:2536
- C:\Windows\system32\ctfmon.exe
  /QuitInfo:0000000000000270;0000000000000274;
  2⤵
  PID:4240

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:2604

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s DusmSvc
1⤵
PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:2700

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Wcmsvc
1⤵
PID:2864

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:2936

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2328

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:3136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc
1⤵
PID:3264

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
PID:3492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:3552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:3564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:3612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:3652

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:3672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Appinfo
1⤵
PID:1108

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4416

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4448

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc
1⤵
PID:4492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k osprivacy -p -s camsvc
1⤵
PID:4716

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4832

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}
1⤵
PID:5168

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:5232

C:\Windows\System32\SecurityHealthSystray.exe
"C:\Windows\System32\SecurityHealthSystray.exe"
1⤵
PID:5272

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k WebThreatDefense -p -s webthreatdefsvc
1⤵
PID:5680

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
PID:1480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4424

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:5296

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:768

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:5116

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
- Drops file in System32 directory
PID:5936

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4824

C:\Users\Admin\AppData\Local\Temp\2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2064
- C:\Users\Admin\AppData\Local\Temp\hcc2v4mz.3ap.exe
  "C:\Users\Admin\AppData\Local\Temp\hcc2v4mz.3ap.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1184
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "Mason2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1456
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5604
- C:\Windows\SYSTEM32\SCHTASKS.exe
  "SCHTASKS.exe" /create /tn "Mason2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe'" /sc onlogon /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3976
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:1600

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:4880

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:4852

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:3712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Process Injection

T1055

Process Hollowing

T1055.012

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Process Injection

T1055

Process Hollowing

T1055.012

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7b1b8531c3ecda17e384155d74dbdad5372357052a9ebf3533d8e2108e27ed8b
MD5 a070d4d5bb36ab9016df792160b50bc9
SHA1 e24444f343ce2071e242381ca398925be73752e5
SHA512 e3c75749a2f6238a1497085256259ddf6a0beb498fa3ffee9c2920bfc75958cc20e77eb197b5c8d28a4279562dea6054bb37e5568624f3fdcabdca698b0f036a
TLSH
T113219833B3CC8624C89A013A10CDAC1036B6C7CB40DECFAB6B80E655A43F698CE60160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 95020e5984331f62fdc225d4a775ceacbd74a149aaed131abd6933ca7b905724
MD5 ac92f3deeb514f3f914550c1416988a8
SHA1 79bf6862b2a493f91c8fe5f1ca9d73308fcf750c
SHA512 8141a873ec4adf7b49d5191cf931145577df223e0131de9cc8bc52a44745bb124b98990cb59a0ae680038e1002429af5fbeb7323e846dc1878a57a1070f7b789
TLSH
T15A216837B3DD8614C89A413A10CDAD1036B6CBDB40DECF9B6B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_ffy10o1p.h4u.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ffy10o1p.h4u.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

xpblenbm.in2.exe

Path C:\Users\Admin\AppData\Local\Temp\xpblenbm.in2.exe
Size 161KB
SHA256 879cc20b41635709bb304e315aaa5ca4708b480a1bfc2f4935fcf2215188efb0
MD5 94f1ab3a068f83b32639579ec9c5d025
SHA1 38f3d5bc5de46feb8de093d11329766b8e2054ae
SHA512 44d5236a804d63302b21ca25ebc148a64605508d03c990a244c44ceb8630849da0510b7b2d0bee72e01ca6681e2d86d7e6aee8847674a26f0028d149b9abee0c
SSDEEP 3072:hLD8KbgVtn8Mo8G1gVziHzZbIK1YKB/pCAcNqXhwBV3yxSQig8xN:h/5bTgVziHzZnSKrCbYM
TLSH
T10BF33C07BAA500F7E976823585739E17B7B2F42503209BBF0B654A6E0FA37906D3DB50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mason.exe

Path C:\Users\Admin\AppData\Roaming\mason.exe
Size 389KB
SHA256 dbaac58137193f9961d52ecef1a3f2a57c780e7dcf8f5d81fe9d59c75f0ec61b
MD5 5f527ec857da66cc62339f6ecfb0ba5b
SHA1 294ba1eff9a10b8d1159f2a703f528ce60e54c09
SHA512 03ccd3233d3fe003b1e0cbe81ba28a90830c7a8efb285a15e02cd85a747d9cbc6afeefcb871863aea7827a1196393bac22192ff44b5e7caf28c2e0b212ecd9d7
SSDEEP 6144:5bM5DZqP5h0Kb3Zhbo/5bTgVziHzZnSKrCbYMx+tb68pLq:5Nhh0K4/5/gVziHlBrCbYu8Y
TLSH
T1C4846C5AF69040EAD4A941328C635B0567B2FC361722E7EF1AD43D9D7F337A04D2AB90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Mason2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe

Path C:\Windows\System32\Tasks\Mason2026-10-22_5f527ec857da66cc62339f6ecfb0ba5b_cobalt-strike_elex_glassworm_icedid_vidar.exe
Size 3KB
SHA256 20b8d265a25a7b23ff3b234ab2bf39b2c7482f64e634f4766105480090836ba9
MD5 eb2e3b07911e17e52f71e319f0ca18c9
SHA1 ac853e4dc03fadd1c0fdbf6d2d5c7dce5fefde35
SHA512 97299bb93d7a1b2c8e984e1d629f6d8752f85588bff24918b10331869bf8899adaab2f65e4e0bd64a15ad5066124eff9b4e1d7bc3ff9d5473e0a3cd5870d01d5
TLSH
T1F2718C4767EE1109F1F7AB2CAAB754628E637C516938C46D01EC240DCBF3E2295607B7
MD5 SHA1 SHA512 TLSH

Submit Download

Masonmason.exe

Path C:\Windows\System32\Tasks\Masonmason.exe
Size 3KB
SHA256 fe06b4b63e88ec937fa71472de764cb8188a534381142131de79b6c8e2b0c04c
MD5 86a31b2ed309b55d27a982919d424600
SHA1 cea875d6b435a4b5851b55667fedbf8330a9cc49
SHA512 f4d7931737641a68136c35958f84496c820593dba2fd929ac1066fd26d29a6a358125642923c99047f7e7a53fc63c15d3a1be5f8ce4af3a94af78217b55a31d3
TLSH
T13F61784367EE1109F2F7AB2CAEB714628E67BD515939C46D00AC240DCBF3E2285607B7
MD5 SHA1 SHA512 TLSH

Submit Download

mason

Path C:\Windows\System32\Tasks\mason
Size 3KB
SHA256 a48afae18c216135137c4faa9acdfab26853a3204618168c76d12e841ed0c8f4
MD5 0b91e3fd437e6fb97020ab5ded657418
SHA1 c991234da155815bb3fec30e1664a2ea7036841c
SHA512 d1c574926e7d80a6183b5fc5d51995a09f1013eb9b717c1fc367d671b58bc4f6655ced1df98cbed35154195bd33a9dcc787a79b10d445c17b1e3071afec0830a
TLSH
T15D71664367EE1109F2F7AB2CAEB714618E677D555938C42D00AC240DCBF3E2285607BB
MD5 SHA1 SHA512 TLSH

Submit Download

dberr.txt

Path C:\Windows\System32\catroot2\dberr.txt
Size 70KB
SHA256 f77209374cefe501d535828f9caac36c01e924bf721d5c0b174e78b292a4566e
MD5 99957f3d2d1593dd3ab33cc3705b2617
SHA1 5ea84542e809468411467691465e0718dc9eaaf3
SHA512 dcb2b188a1f7b6b5e8176364eb29a3812556e2eace9e650c67c01d3f457d2eee3bf04b97fdc19329211a90658039797d4858908003b5739dd8fe02f1f6f439fa
SSDEEP 1536:5dLAGlAJNMrzVF2AYDV5C9+hZ8Gcb0kfZBRyPzZQLT9wDT3TkqouH83+HeQ7FqpT:HGAT
TLSH
T1CC630B0580D8C609C9B609A27277EDB2D57A66EE771F0EE730AD6300D9C2F053F7A469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 30422c63f8d8ba8e5733e26401bd3f197a5b29d8667f59242188ce56c3e0754f
MD5 76c9b9665f3249502ac0d40f5f218226
SHA1 2a95c7d200ef8e54252d59a0a9c84eaefebc0a14
SHA512 e94e05dc7bb09e5616551c4542db7f6ee4c159da7306d4e1dbc3a458e98f9a491d78b5fc909982ae1e9df2897a578e0fd99ea0f9fb05e7b84784f05f9412f761
TLSH
T187E08CA23AA41200F2330A3CBAB2A1814B37B66B6901CACA2734108E5C39F248837619
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419

Path C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419
Size 412B
SHA256 cd947aa48ec5177f0ebe679a35b643beb141da2919d492d499b2342c155524ed
MD5 46f439d0b4fce2cadbb7ef55e5208d04
SHA1 5a37bc5376e284dd1a43bbb473bbe571c059f67c
SHA512 2021d932e5f6adacc989fd9c8584970a1965f2f65ee48bc0a7c0a51c7dd6e0b688ac261a0e567bb8969475220450f89fba94c848d2afe24df627a399c7ef11d1
TLSH
T1F8E0C02413FB502CF0E4C43C8BD5682116DAF071080CB1B82BE11704A317540EC02938
MD5 SHA1 SHA512 TLSH

Submit Download

memory/496-628-0x000001211F010000-0x000001211F03B000-memory.dmp

Download

memory/496-35-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/496-34-0x000001211F010000-0x000001211F03B000-memory.dmp

Download

memory/496-282-0x000001211F010000-0x000001211F03B000-memory.dmp

Download

memory/756-17-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/756-16-0x000001A719230000-0x000001A71925B000-memory.dmp

Download

memory/756-15-0x000001A719200000-0x000001A719225000-memory.dmp

Download

memory/756-624-0x000001A719230000-0x000001A71925B000-memory.dmp

Download

memory/756-278-0x000001A719230000-0x000001A71925B000-memory.dmp

Download

memory/972-30-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/972-626-0x000001F6D09F0000-0x000001F6D0A1B000-memory.dmp

Download

memory/972-280-0x000001F6D09F0000-0x000001F6D0A1B000-memory.dmp

Download

memory/972-29-0x000001F6D09F0000-0x000001F6D0A1B000-memory.dmp

Download

memory/980-281-0x000001A4527F0000-0x000001A45281B000-memory.dmp

Download

memory/980-32-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/980-31-0x000001A4527F0000-0x000001A45281B000-memory.dmp

Download

memory/980-627-0x000001A4527F0000-0x000001A45281B000-memory.dmp

Download

memory/1044-38-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/1044-37-0x0000023296FD0000-0x0000023296FFB000-memory.dmp

Download

memory/1044-629-0x0000023296FD0000-0x0000023296FFB000-memory.dmp

Download

memory/1044-283-0x0000023296FD0000-0x0000023296FFB000-memory.dmp

Download

memory/1132-284-0x00000228B4EF0000-0x00000228B4F1B000-memory.dmp

Download

memory/1132-40-0x00000228B4EF0000-0x00000228B4F1B000-memory.dmp

Download

memory/1132-41-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/1132-630-0x00000228B4EF0000-0x00000228B4F1B000-memory.dmp

Download

memory/1176-25-0x000001CF469C0000-0x000001CF469EB000-memory.dmp

Download

memory/1176-279-0x000001CF469C0000-0x000001CF469EB000-memory.dmp

Download

memory/1176-26-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/1176-625-0x000001CF469C0000-0x000001CF469EB000-memory.dmp

Download

memory/1244-113-0x000002C5B9100000-0x000002C5B912B000-memory.dmp

Download

memory/1244-114-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/1300-117-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/1300-116-0x000001B6BEB20000-0x000001B6BEB4B000-memory.dmp

Download

memory/1360-120-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/1360-119-0x00000194FE870000-0x00000194FE89B000-memory.dmp

Download

memory/1528-631-0x0000022526650000-0x000002252667B000-memory.dmp

Download

memory/1528-47-0x0000022526650000-0x000002252667B000-memory.dmp

Download

memory/1528-285-0x0000022526650000-0x000002252667B000-memory.dmp

Download

memory/1528-48-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/1596-123-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/1596-122-0x0000026824D80000-0x0000026824DAB000-memory.dmp

Download

memory/1688-125-0x000002B649A50000-0x000002B649A7B000-memory.dmp

Download

memory/1688-126-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/1696-128-0x00000221DBC30000-0x00000221DBC5B000-memory.dmp

Download

memory/1696-129-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/1708-131-0x00000140A14D0000-0x00000140A14FB000-memory.dmp

Download

memory/1708-132-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/1716-135-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/1716-134-0x000002279D5E0000-0x000002279D60B000-memory.dmp

Download

memory/1972-137-0x0000022577B00000-0x0000022577B2B000-memory.dmp

Download

memory/1972-138-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/2040-140-0x000001806CDC0000-0x000001806CDEB000-memory.dmp

Download

memory/2040-141-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/2064-325-0x0000013AC9770000-0x0000013AC97D8000-memory.dmp

Download

memory/2088-144-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/2088-143-0x0000021A07BB0000-0x0000021A07BDB000-memory.dmp

Download

memory/2112-146-0x000001D0E6B60000-0x000001D0E6B8B000-memory.dmp

Download

memory/2112-147-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/2136-149-0x0000019B38EC0000-0x0000019B38EEB000-memory.dmp

Download

memory/2136-150-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/2260-152-0x000002C02FFD0000-0x000002C02FFFB000-memory.dmp

Download

memory/2260-153-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/2340-156-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/2340-155-0x00000290D3770000-0x00000290D379B000-memory.dmp

Download

memory/2360-159-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/2360-158-0x00000230795C0000-0x00000230795EB000-memory.dmp

Download

memory/2484-161-0x0000015FA9D70000-0x0000015FA9D9B000-memory.dmp

Download

memory/2484-162-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/2536-164-0x000001FE82D50000-0x000001FE82D7B000-memory.dmp

Download

memory/2536-165-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/2604-167-0x000001DBB97E0000-0x000001DBB980B000-memory.dmp

Download

memory/2604-168-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/2672-170-0x000001CFA6800000-0x000001CFA682B000-memory.dmp

Download

memory/2672-171-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/2700-173-0x000001FDB3D80000-0x000001FDB3DAB000-memory.dmp

Download

memory/3480-287-0x0000000000FC0000-0x0000000000FEB000-memory.dmp

Download

memory/3480-633-0x0000000000FC0000-0x0000000000FEB000-memory.dmp

Download

memory/3480-106-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/3480-105-0x0000000000FC0000-0x0000000000FEB000-memory.dmp

Download

memory/4240-286-0x000001CA75230000-0x000001CA7525B000-memory.dmp

Download

memory/4240-91-0x00007FFBC39A0000-0x00007FFBC39B0000-memory.dmp

Download

memory/4240-90-0x000001CA75230000-0x000001CA7525B000-memory.dmp

Download

memory/4240-632-0x000001CA75230000-0x000001CA7525B000-memory.dmp

Download

memory/4976-620-0x00007FFBE0D70000-0x00007FFBE1714000-memory.dmp

Download

memory/4976-634-0x00000244F7CB0000-0x00000244F7CC0000-memory.dmp

Download

memory/4976-1-0x00007FFBE0EFF000-0x00007FFBE0F00000-memory.dmp

Download

memory/4976-491-0x00000244F7F60000-0x00000244F7F7C000-memory.dmp

Download

memory/4976-813-0x00000244F7CB0000-0x00000244F7CC0000-memory.dmp

Download

memory/4976-2-0x00000244F5A40000-0x00000244F5A6C000-memory.dmp

Download

memory/4976-0-0x00000244F5580000-0x00000244F55E8000-memory.dmp

Download

memory/4976-4-0x00007FFBE0D70000-0x00007FFBE1714000-memory.dmp

Download

memory/4976-28-0x00007FFBE0D70000-0x00007FFBE1714000-memory.dmp

Download

memory/4976-623-0x00007FFBE0D70000-0x00007FFBE1714000-memory.dmp

Download

memory/4976-5-0x00007FFBE0D70000-0x00007FFBE1714000-memory.dmp

Download

memory/5140-14-0x00007FFC02A40000-0x00007FFC02B07000-memory.dmp

Download

memory/5140-13-0x00007FFC03860000-0x00007FFC03AC3000-memory.dmp

Download

memory/5876-521-0x000001D178170000-0x000001D17817A000-memory.dmp

Download

memory/5876-519-0x000001D178090000-0x000001D1780AE000-memory.dmp

Download

memory/5876-516-0x000001D177FF0000-0x000001D178012000-memory.dmp

Download

memory/5876-520-0x000001D1780B0000-0x000001D178162000-memory.dmp

Download